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INTRODUCTION 


This  report  presents  the  results  of  a preliminary  study 
to  determine  the  high-altitude  electromagnetic  pulse  (HEMP) 
protection  measures  required  for  the  Decentralized  Automated 
Service  Support  System  (DAS3).  This  study  examined  the 
planned  system  configuration  based  on  procurement 
spec!  f I cations.1'2 

The  DAS3  system  is  a decentral i zed  and  mobile  ADPE 
conf Igurat ion  whose  purpose  is  to  fulfill  the  functional 
software  requirements  of  the  Direct  Support  Unit  Standard 
Supply  System  (DS4)  at  the  retail  level  of  the  Army  In  the 
field.  DS4  Is  a standardized  supply-management  Information 
system  currently  under  development. 

The  DAS3  system.  In  the  DS4  configuration,  will  provide 
the  capability  to  handle  daily  stock  control  and  storage 
functions,  reconciliation,  quick  supply  store  procedures, 
catalog  data,  and  demand  analysis. 

The  proposed  DAS3  system  consists  of  automatic  data 
processing  (ADP)*  equipment  (ADPE)  Installed  In  a 35-ft-long 
semitrailer  van.  The  ADPE  Is  powered  by  either  commercial 
electric  power  or  mobile  electric  power  (MEP)  consisting  of 
two  MEP-005A  30-kW  diesel  generators,  one  of  which  Is 
provided  for  backup.  The  power  Is  120/208  Vac  nominally,  at 
50/60  Hz.  The  planned  MEP  configuration  Is  an  AN/MJQ-10A 
system  made  up  of  two  PU  406B/M  generator  sets.  The 
semitrailer  van  to  be  used  Is  designated  the  XM971.  This 
van  Is  a modified  version  of  the  XM913. 


*RFP,  Solicitation  No.  DAHC26-78-R-0001,  Automated  Data 
Processing  Equipment,  Decentralized  Automated  Service 
Support  System;  A Mobile,  Van-Mounted  Management  Information 
System  (17  May  1978). 

2Specl f (cation  for  the  Decentralized  Automated  Service 
Support  System  DAS3,  Tactical  Management  Information  Systems 
Project  Management  Office  (February  1978). 

*A  glossary  Is  tncl  ied  at  the  end  of  this  report. 
Included  In  the  glossary  are  terms  and  acronyms  used  In  this 
report  which  have  vague  or  unknown  meaning  outside  the  EMP 
or  ADP  communities  or  which  have  special  meaning  as  used  In 
the  context  of  this  report. 


1.1 


Object!  ve 


The  Intent  of  this  effort  was  to  examine  the 
proposed  0AS3  system  to  (1)  Identify  possible  or  probable 
HEMP  susceptibilities/  (2)  provide  corresponding  hardening 
recommendations  which  could  be  Implemented  at  the  current 
stage  of  the  procurement  cycle/  and  (3)  Identify  any  need 
for  further/  more  detailed  testing  or  analysis. 

1.2  Summary  of  Results 


The  following  overall  conclusions  were  reached 
based  on  certain  assumptions  concerning  the  system 
construction  and  configuration  (see  sect.  4)  and  subject  to 
certain  limitations  (see  sect.  5). 

The  HEMP  assessment  of  DAS3  was  divided  into  two 
major  parts.  One  part  addressed  the  HEMP  survivability  of 
the  ADPE  In  the  XM971  semitrailer  van.  The  other  part 
addressed  the  HEMP  survivability  of  the  mobile  electric 
power  (MEP).  A third/  more  minor/  question  addressed  was 
the  vulnerability  of  magnetic  tapes  and  disks.  The  HEMP 
survivability  conclusions  are  summarized  In  table  1. 

Summarized  In  table  II  are  the  recommended 
HEMP-hardenl ng  measures  for  DAS3  (discussed  In  detail  In 
sect.  6).  Those  measures  listed  In  the  column  labelled 
"Required  for  protection  from  both  damage  and  upset1'  are 
considered  to  be  required  for  the  predicted  damage  and  upset 
conclusions  for  the  ADPE  to  be  valid.  The  measures  listed 
In  the  other  two  columns  of  table  II  are  optional  (desired)/ 
suggested  as  means  for  providing  additional  margins  of 
protection  or  added  confidence.  Any  of  these  measures  which 
can  be  implemented  without  cost  Impact  should  be 
Implemented.  The  use  of  gasketing  around  MEP  access  doors 
and  shielded  power  cables  Is  a measure  to  assure  hardness  of 
the  MEP,  although  this  Is.  not  known  to  be  necessary  or 
adequate  based  on  this  study.  The  vestibule  arrangement 
could  be  used  If  the  requirement  for  closed  doors  on  the  van 
cannot  be  met.  Various  of  the  optional  hardening  measures 
could  be  needed  if  future  analysis  reveals  deficiencies. 

If  the  recommended  hardening  measures  are 
Implemented  and  the  proposed  follow-up  analyses  are 
performed,  DAS3  Is  predicted  to  survive  the  HEMP 
environment.  The  planned  DAS 3 configuration  presents  no 
major  roadblocks  to  achieving  HEMP  hardness.  This  Is 
attributed  In  part  to  the  fact  that  all  ADPE  Is  Inclosed  In 
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TABLE  I 


SUMMARY  OF  DAS!  HEMP  SURVIVABILITY 


Category 

Survl vabl 1 1 ty 

Proposed 

AOPE 

(damage 

Predicted  hard  assuming 
> required  hardenl;>£ 

measures  are 

Implemented 

For  added  confidence: 

(1)  further  analysis 
once  ADPE  has  been 
defined 

(2)  verification  HEMP 
simulation  test  of 
system 

ACPE 
(upset ) 

Predicted  hard  assuming 
required  hardening 
measures  are 

Implemented 

For  added  confidence: 
further  analysis  once 
ADPE  has  been  defined 

MEP 

Unable  to  reach  a 
conclusion  based  on 
this  study 

HEMP  simulation  test 
to  determine  coupling 
to  Internal  and 
external  MEP  cables 

MEP 
swl tch 
box 

Hard 

Magnetic 
tapes  B 
disks 

Hard 

TABLE 

II.  REQUIRED  AND  OPTIONAL  HEMP  HARDENING  MEASURES 
RECOMMENDED  FOR  DAS! 

Required  for  Desired  for  Desired  for 

damage  and  upset  damage  and  upset  upset  protection 

protection  protection  only 

Assure  that  TPO'a  at 
power  and  signal 
entry  panels  are 
adequate  for  HEMP 

External  system 
properly  grounded 

Proper  Installation 
of  power  and  signal 
entry  panels 

Proper  Installation 
of  air  conditioning 

No  addl tlonal 
apertures  or 
penetrators 


Gasketing  around 
MEP  access  doors 

Proper  grounding 
scheme  for 
Inside  of  van 

Vestibule  for  van 
entrance 

Ducting  for 
cables  Inside 
van 

Shielded  power 
cables  to 
protect  MEP 


Error  checking  for 
memory,  all 
storage  devices, 
and  all  data 
transfers  both 
Internal  and 
external  to  system 

EMP  detector  scheme 


Standard  requirement 
that  doors  ba  kept 
closed 


Hardness-assurance 
procedures  which 
Include  maintenance 
of  door  gaskets, 
etc 


a metallic  van  structure/  and  In  part  to  the  conscientious 
efforts  of  the  Tactical  Management  Information  Systems 
Project  Management  Office  (TACMIS  PMO).  TACMIS  PMO 
carefully  selected  the  XM971  van  for  Its  electromagnetic 
shielding  characteristics.  Although  the  AOPE  Request  for 
Proposals  (RFP)1*2  does  not  contain  a specific  HEMP 
survivability  specification/  It  does  Include  several 
requirements  which  are  useful  for  HEMP  protection.  These 
requirements  Include  (1)  electromagnetic  shielding/ 
(2)  power-fall  protection/  (3)  filtering  and  surge 
suppression  of  transients  at  cable  entry  panels/  (4)  power 
transient  protection/  and  (5)  a comprehensive  plan  for 
toleration  of  upset  faults  (HEMP-trans I ent  caused  or 
otherwise)  through  hardware  redundancy/  checkpoint  rollback 
procedures/  hardware  error  detection/  and  standard  operating 
procedures  for  maintaining  backup  copies  of  critical 
1 nformatlon. 


1.2.1  Automatic  Data  Processing  Equipment 

The  0AS3  AOPE  Is  predicted  to  be  hard  to 
HEMP-1 nduced  damage/  based  on  engineering  judgement/  when 
the  recommended  hardening  measures  described  In  section  6 
are  properly  Implemented.  The  accuracy  of  this  hardness 
statement  depends  especially  on  the  ADPE's  compliance  with 
the  specifications  called  for  In  the  DAS3  RFP1  and  the 
Specifications  for  DAS3/2  as  highlighted  In  section  4 of 
this  report.  The  confidence  associated  with  this  prediction 
Is  necessarily  lower  than  desired  because  of  a lack  of 
specific  equipment  Information  and  HEMP  test  data  (see 
sect.  5). 


So  that  the  confidence  of  the  above  hardness 
statement  may  be  Improved/  It  Is  recommended  that  a refined 
study  be  conducted  when  the  specific  AOPE  has  been  defined. 
Upon  availability  of  a prototype  DAS3  system,  a limited  test 
Is  also  recommended  to  further  verify  the  overall  hardness 
of  the  system. 


*RFP,  Solicitation  No.  DAHC26-78-R-0001/  Automated  Data 
Processing  Equipment,  Decentralized  Automated  Service 
Support  System;  A Mobile,  Van-Mounted  Management  Information 
System  (17  May  1978). 

2Speclf (cation  for  the  Decentralized  Automated  Service 
Support  System  DAS3,  Tactical  Management  Information  Systems 
Project  Management  Office  (February  1978). 
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With  regard  to  HEMP-1 nduced  upset  of  the 
ADPE,  the  required  hardware  and  software  measures  and 
planned  procedures  for  upset  toleration  appear  adequate  to 
meet  the  DAS3  mission  requirements.  The  only  possible 
weakness  Is  In  the  ability  of  the  system  to  detect  all 
likely  types  of  upsets.  Upset  detection  Is  essential  In 
order  for  the  system  to  be  able  to  carry  out  Its  correction, 
restoration,  and  recovery/restar t measures. 

Further  study  of  the  specific  ADPE,  when  It 
has  been  defined.  Is  recommended  In  order  to  verify  the 
system's  ability  to  detect  upsets  likely  to  be  caused  by 
HEMP. 

1.2.2  Mobile  Electric  Power  (MEP) 

This  analytical  assessment  did  not  provide  a 
definite  statement  on  the  HEMP  susceptibility  of  the 
MEP-005A,  30-kW  generator  set.  No  specific  component  or 
circuit  was  Identified  as  definitely  vulnerable.  On  the 
other  hand,  the  presence  of  a large  number  of  Inherently 
sensitive  semiconductor  components  embedded  In  the  complex 
control  circuits  of  the  generator  provides  sufficient  reason 
to  question  the  HEMP  hardness  of  the  generator. 

HEMP  vulnerability  of  the  MEP-005A  Is 
further  Indicated  by  the  results  of  an  unpublished  HEMP 
assessment  and  brief  test  conducted  by  the  Harry  Diamond 
Laboratories  (HDL)  In  1975.  In  that  study  a 15-kW  generator 
was  addressed  as  part  of  an  examination  of  possible  MEP  to 
be  used  by  the  Patriot  (formerly  SAM-D)  missile  system. 
According  to  discussions  with  knowledgeable  staff  at  the 
Army  Mobility  Equipment  Research  and  Development  Command 
(MERADCOM)  MEP  group,  the  15-kW  unit  Is  similar  to  the 
MEP-005A.  Unfortunately,  sufficient  details  concerning  the 
HEMP  study  of  the  15-kW  unit  could  not  be  obtained  and  as  a 
result  extrapolation  of  the  results  to  the  MEP-005A  was  not 
possible.  What  Information  was  found,  however,  leads  one  to 
believe  the  15-kW  generator  Is  vulnerable.  A summary  of  the 
results  follows. 

Testing  was  conducted  on  the  15-kW  generator 
to  determine  hardening  fixes.  This  testing  examined  two 
types  of  fixes.  The  first  fix  consisted  of  sanding  the 
periphery  of  the  generator  access  doors  where  they  mate  with 
the  generator  Inclosure;  a conductive  silver-based  chemical 
was  then  applied  to  the  mating  surfaces.  The  second  fix 
consisted  of  the  Installation  of  an  additional  honeycomb 


9 


aluminum  grill  to  the  air  intake  port.  The  first  fix  was 
Implemented  and  seemed  to  prove  sufficient.  The  second  fix 
was  never  permanently  Installed.  No  formal  conclusions  or 
recommendations  were  documented.  Because  of  the  limited 
nature  of  the  test#  no  official  HDL  position  was  reached  as 
to  the  survivability  of  the  generator. 

It  Is  Important  to  note  that  neither  the 
above-mentioned  fixes  nor  any  similar  measures  have  been 
incorporated  on  standard  15-kW  generators  or  on  the 
MEP-005A.  It  Is  also  Interesting  to  note  that  the  generator 
used  for  the  Patriot  HEMP  study  was  examined  at  MERADCOM  and 
the  first  fix  was  evident  on  the  unit.  The  s I 1 ver-pal nted 
surfaces  had  rusted  severely  to  the  point  where  any  HEMP 
shielding  benefit  from  the  fix  Is  questionable. 

The  only  way  to  be  able  to  adequately  assess 
the  MEP-005A  HEMP  susceptibility  Is  to  obtain  measurements 
of  HEMP  energy  coupled  to  the  generator  via  Internal  and 
external  cabling.  These  coupling  data  would  then  be  used  to 
conduct  detailed  circuit  analysis  on  the  MEP-005A 
cl rcul try. 

The  switch  box  used  In  the  AN/MJQ-10A 
configuration  to  connect  the  two  MEP-005A  units  should 
survive  the  HEMP  environment.  Initially  the  switch  box  was 
thought  to  be  a possible  problem;  however,  examination  of 
the  switch  box  circuitry  revealed  the  presence  of  only 
mechanical  switches  and  neon  Indicator  lights. 

Consideration  was  also  given  to  physically 
disconnecting  the  backup  generator  from  the  switch  box  when 
not  In  use  In  order  to  Isolate  the  generator  and  thus 
protect  It  from  HEMP  transients  Induced  on  the  cables.  This 
step  Is  not  considered  necessary  In  light  of  the  short 
length  of  cables  Interconnecting  the  generators  and  In  light 
of  the  presence  of  the  mechanical  switches  In  the  switch 
box . 


1.2.3  Magnetic  Tapes  and  Disks 

Magnetic  tapes  and  disks  when  In  a passive 
state  can  be  considered  hard  to  all  expected  HEMP  field 
levels.  Including  all  postulated  threat  levels.  Any 
possible  upset  or  damage  to  such  storage  media  Is  limited  to 
that  caused  by  the  equipment  which  accesses  them  (I.e.,  tape 
drives  and  disk  drives).  Further,  tapes  and  disks  are  not 


normally  subject  to  damage  and  upset  even  when  mounted  on 
drtves  unless  read  or  write  operations  are  In  progress  when 
the  drtves  experience  the  effects  of  an  HEMP  transient. 

The  f '.•'dness  of  passive  tapes  and  disks  Is 
supported  by  other  Investigations/  as  Indicated  by  the 
following  excerpt  from  a Bell  Laboratories  document:3 

"...  tests  show  that  magnetic  tape  Is  not 
sensitive  to  EMP  even  at  high  levels.  Repeated  exposures 
failed  to  cause  data  errors  or  degradation  of  stored 
Information.  Such  alteration  requires  a few  hundred  gauss# 
while  typically  EMP  generates  a magnetic  field  of  only  a few 
gauss." 


These  results  are  further  supported  by  a 
test  conducted  by  HDL#  where  magnetic  tapes  were  subjected 
to  the  AESOP  HEMP  simulator  which  produced  55  kV/m  at  the 
tape  location  (28.3  m out#  30  m radial  distance  from 
antenna).  Tapes  were  located  on  a 1.4-m-hlgh  wooden  pallet 
and  configured  In  numerous  orientations.  The  tapes  were 
subjected  to  6 pulses  at  10-minute  Intervals  for  each  of  6 
orientations.  The  complete  contents  of  all  tapes  was 
verified  before  and  after  testing  and  showed  no  degradation 
due  to  the  simulated  HEMP  field  environment. 


2.  DAS3  SYSTEM  OVERVIEW  AND  HARDENING  APPROACH 

DAS3  and  the  new  DS4  are  scheduled  to  be  used  In  the 
near  future  to  provide  logistics  management  for 
nondlvlslonal  Direct  Support  Unit/General  Support  Units 
(DSU/GSU).  The  development  of  DS4  software  Is  the 
responsibility  of  the  Army  Logistics  Center.  The 
development  of  the  total  DAS3  system  Is  the  responsibility 
of  TACMIS  PMO. 

DAS3  Is  to  be  modular  In  design  to  perml t tailoring  and 
expansion  of  the  ADPE  so  that  DAS3  can  be  a potential 
replacement  for  divisional#  separate  brigade,  and  corps 
support#  command#  supply#  and  maintenance  functional  ADPE 
for  1981  and  beyond. 

The  XM971  semitrailer  van#  MEP#  and  ai r-condl tlonlng 
units  for  the  van  are  government-furnished  equipment  (GFE). 

3EMP  Engineering  and  Design  Principles#  Bell  Telephone 
Laboratories  (1975). 
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The  ADP  equipment  Is  off-the-shelf  commercial  equipment, 
which  Is  not  ruggedlzed  for  military  use.  The  proposals 
concerning  the  procurement  of  the  Initial  193  systems 
(Including  the  ADPE  hardware)  and  the  Installation  and 
assembly  of  the  Gt-'E  and  ADP  hardware  Into  the  final  system 
have  been  being  evaluated  throughout  this  study. 

The  DAS3  ADPE  In  Its  DS4  configuration  will  consist  of  a 
ml nl computer-type  system  which  Includes  at  least  the 
following  peripheral  equipment. 

1 system  console-keyboard  visual  display  and 
printing  terminal 

2 user  keyboard  visual  display  terminals  (KVDT) 

1 line  printer  (200  lines  per  minute) 

1 card  reader  (200  cards  per  minute) 

1 card  punch  (35  cards  per  minute) 

2 magnetic  tape  drives  (800/1600  blts/ln.,  35 
In. /s ) 

1 magnetic  tape  controller 

3 disk  drives  controlled  Interchangeably  by  2 disk 
controllers  (120-megabyte  capacity  total, 
180,000  bytes  per  second  data  transfer  rate, 
average  access  time  60  ms  or  faster,  removable 
disk  pack  type) 

1 communications  controller  capable  of  controlling 
up  to  eight  keyboard  visual  display  terminals 

1 keypunch/interpreter 

Any  two  of  the  three  disk  drives  will  provide  storage 
capacity  for  100-percent  system  operation.  Either  of  the 
two  disk  controllers  will  be  able  to  control  any  or  all  of 
the  three  system  disk  drives.  A backup  system  console, 
possibly  one  of  the  user  KVDT’s,  Is  required. 

The  DAS3  procurement  specifications  provide  for  fault 
avoidance  and  fault  tolerance  at  various  levels.  A partial 
list  of  such  requirements  Includes  transient  filtering  and 
surge  suppression  for  exterior  cabling  which  penetrates  the 
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van,  hardware  redundancy  for  disk  drives,  a checkpoint 
rollback  (CPRB)  mode  of  operation  for  all  software,  power 
fall  protection,  and  error  detection/correction. 

The  use  of  off-the-shelf  commercial  equipment  that  Is 
not  ml  1 1 tary-rugged I zed  makes  the  DAS3  somewhat  unusual. 
Indeed,  virtually  all  past  HEMP  assessments  have  addressed 
custom-designed  military  or  Defense  Communl cat  Ions  System 
equipment.  DAS3  represents  a growing  trend,  especially  In 
ADP,  to  minimize  design  and  engineering  costs  by  taking 
advantage  of  existing  and  proven  equipment.  The  logical 
extension  of  this  philosophy  to  HEMP  hardening  suggests  that 
one  should  strive  to  achieve  hardness  through  design  or 
modification  of  the  system  tnclosure  rather  than  through 
modification  of  the  existing  electronic  equipment.  For 
DAS3,  It  Is  desirable  to  limit  modifications  and  changes  to 
the  van  shelter  or  equipment  Installation  procedures. 

For  the  latter  reason,  and  because  of  a lack  of  specific 
Information  concerning  the  DAS3  ADPE,  the  emphasis  of  this 
HEMP  assessment  was  toward  protection  at  the  overall 
shielding  level  (van  walls).  Such  protection  Is  considered 
achievable  for  a system  like  DAS3  which  Is  concerned  with 
HEMP-Induced  damage  only.  (Protection  against  upset  by 
shielding  of  the  system  Inclosure  Is  much  more  difficult.) 
The  DAS3  system  mission  Is  such  that  It  need  not  operate 
through  an  HEMP  event.  As  a result,  DAS3  can 
cost-effectively  protect  against  HEMP-Induced  upset  through 
Its  use  of  various  fault-tolerance  measures  such  as  power 
fall  protection,  checkpoint  rollback,  and  hardware 
redundancy. 

As  a tangential  note.  It  should  be  pointed  out  that  a 
general  Army  need  exists  for  shelters,  specifically  the 
35-ft  van  variety,  that  have  been  specifically  hardened  to 
HEMP.  It  Is  felt  that  substantial  Improvements  In  shielding 
effectiveness  could  be  achieved  over  presently  aval iable 
vans,  at  relatively  low  cost,  through  a good  HEMP 
shelter-hardening  program.  Furthermore,  specific 
quantitative  knowledge  of  HEMP  shielding  effectiveness  of 
vans  would  help  to  avoid  low-confidence  hardening  and 
overhardening.  An  Army  product  manager  who  Is  fielding  a 
new  system  needs  to  be  able  to  select  an  HEMP-hardened 
semitrailer  van  from  Army  Inventory.  The  alternative 
approach  Is  that  which  TACMIS  PMO  faced  wl  *.h  DAS3:  trying 
to  make  do  with  a van  which  Is  carefully  selected  but, 
nevertheless,  may  have  unknown  HEMP  shielding  attributes. 
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3.  HEMP  DESCRIPTION  AND  HARDENING  PHILOSOPHY 


3 , 1 General 

The  effects  of  HEMP  on  ADPE,  or  computer  equipment, 
are  worthy  of  special  attention  because  of  the  Inherent, 
relatively  high,  susceptibility  of  such  equipment  as  a 
category  compared  to  military  equipment  In  general.  This 
Inherent  susceptibility  Is  due  to  the  presence  of  large 
numbers  of  electronic  circuits  In  all  present-day  computer 
central  processors  and  controllers  and  In  virtually  all 
computer  peripheral  equipment  and  stand-alone 
record-processing  equipment. 

Contributing  to  this  susceptibility  Is  the  fact 
that  much  of  this  electronics  Is  low-level  digital  logic 
circuitry.  These  electronic  circuits  normally  operate  at 
signal  ievels  of  only  a few  volts.  The  countless 
semiconductor  components  In  these  circuits  Inherently  can 
dissipate  only  very  low  amounts  of  energy. 

The  acronym  HEMP  (sometimes  HAEMP)  refers  to  the 
h I gh-al t 1 tude  electromagnetic  pulse  phenomenon  which  Is  a 
by-product  of  a hlgh-altltude  nuclear  burst.  The  broader 
term  EMP  Includes  various  categories  of  EMP,  all  associated 
with  nuclear  bursts.  HEMP  Is  one  category.  Others  are  the 
low-altitude  EMP  (LEMP  or  sometimes  LAEMP),  system-generated 
EMP  (SGEMP),  and  Internal  EMP  (I EMP).  This  report  Is 
concerned  primarily  with  HEMP. 

The  major  reason  for  limiting  this  report  to  HEMP 
Is  the  high  field  levels  and  large  area  of  coverage  expected 
from  an  exoatmospher Ic  burst.  Nuclear  explosions  at  lower 
altitudes  can  be  expected  to  produce  comparable  field  levels 
to  HEMP  but  the  areas  of  Illumination  are  much  more 
constrained  and  the  waveshapes  and  propagation  character  are 
very  different.  Further,  at  lower  altitudes  other  effects 
of  nuclear  explosions,  such  as  blast,  thermal  radiation,  and 
nuclear  radiation,  tend  to  dominate.  Hardening  measures 
proposed  here  are  compatible  with  measures  required  for 
LEMP. 

The  postulated  tactical  and  strategic  EMP  threats 
consist  of  a high-level  electromagnetic  field  environment  In 
the  area  around  a system.  The  amplitude  of  this  field  Is 
tens  of  ktlovolts  per  meter.  The  field  rises  to  Its  peak  In 
several  nanoseconds.  For  exoatmospher Ic  bursts  the  field 
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decays  to  10  percent  of  Its  peak  In  about  a microsecond. 
For  endoatmospherlc  bursts  the  peak  level  Is  slightly  lower 
and  the  10-percent  decay  time  Is  about  a millisecond. 

The  hi gh-ampl I tude  HEMP  envlronnent  has  the 
potential  of  producing  large  electrical  transients  on  system 
electrical  cables  and  metallic  structures.  The  transients 
are  subsequently  propagated  Into  the  system  electronic 
circuits.  Unless  HEMP  protection  measures  exist,  the  system 
can  be  seriously  damaged  or  disrupted.  Component  burnout  or 
degradation  Is  highly  likely  In  circuits  that  (1)  are 
directly  connected  to  telephone,  power,  or  signal  cables 
that  extend  unprotected  Into  the  HEMP  environment  or  (2)  are 
directly  connected  to  Input/output  signal  or  power  cables 
that  run  between  peripherals  and  equipment  racks  In  a 
marginally  shielded  system  environment.  Components  embedded 
more  deeply  within  the  circuits,  away  from 
transient-carrying  media,  are  typically  less  likely  to  fall, 
although,  because  of  Inherent  nonl Inear  I ties  In  electronic 
circuits,  damage  and  upset  can  still  occur. 

A particular,  very  serious,  vulnerability  problem 
for  digital  circuits  In  computer  equipment  Is  the  potential 
disruption  of  logic  states  and  the  alteration  of  digital 
signals.  HEMP-produced  transients  can  distribute  energy 
throughout  the  system  via  Interconnecting  power  and  signal 
wiring,  affecting  circuit  Input  levels,  power  bias,  and 
reference  levels.  Further,  the  resultant  change  In  circuit 
outputs  and  performance  can  cause  disruptive  effects  to  be 
transmitted  to  other  circuits,  ultimately  disrupting  large 
portions  of  the  computer  system. 

The  present  trend  of  designing  computer  systems  to 
function  at  lower  and  lower  logic  levels  and 
power-dissipation  levels  makes  the  upset  problem 
Increasingly  difficult  to  prevent.  For  many  systems  It  Is 
not  realistic  to  shield  or  otherwise  protect  the  system 
elements  from  transients  that  will  be  disruptive.  The 
result  Is  that  measures  often  must  be  taken  to  permit  the 
system  to  tolerate  upsets,  so  that  overall  performance  Is 
not  adversely  affected. 

Semiconductors  are  traditionally  considered  the 
most  HEMP-sensI tlve  components.  But  ft  should  be  pointed 
out  that  other  electrical  components,  like  capacitors  and 
resistors,  are  also  susceptible. 
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Common  hardening  protection  measures  for 
electromagnetic  Interference  (EMI)  and  electromagnetic 
compatibility  (EMC),  lightning,  electrical  overloads,  and 
brownouts  provide  some  protection  against  the  HEMP  threat, 
but  these  measures  fall  short  of  adequate  protection.  The 
frequency  range  of  the  HEMP  threat  Is  much  broader  than  for 
some  of  these  phenomena.  HEMP-1 nduced  transients  are 
typically  much  higher  In  amplitude  than  transients  caused  by 
the  other  effects  (except  lightning).  Protection  devices 
for  the  other  phenomena,  that  shield,  divert,  or  dissipate 
transients,  either  fall  to  react  quickly  enough,  operate  at 
the  wrong  levels,  or  fall  to  eliminate  an  adequate  portion 
of  the  HEMP-! nduced  energy. 


3.2  Damage  and  Upset 


The  problems  caused  by  HEMP  can  be  divided  Into  two 
categories:  damage  and  upset.  Damage  Is  the  Irreversible 
failure  of  an  electrical  component.  This  typically  can 
occur  at  levels  as  low  as  50  V.  Examples  of  damage  are 

(1)  burnout  of  a transistor,  diode,  or  Integrated  circuit, 

(2)  degradation  of  a semiconductor's  operating 
characteristics  so  that  It  will  no  longer  function  as 
Intended,  and  (3)  voltage  breakdown  of  a capacitor  or 
resistor. 


Upset  Is  the  unwanted  action  of  a system, 
subsystem,  or  component.  Upset  typically  occurs  at  levels 
on  the  order  of  1 V.  Examples  of  upset  are  (1)  altering  of 
a flip-flop  state,  (2)  altering  of  one  or  more  bits  In  a 
memory  word  or  register,  (3)  communication  errors,  and 
(4)  misread,  miswritten,  or  overwritten  areas  of  storage  or 
memory. 


The  threshold  levels  for  damage  and  upset  provided 
above  are  approximate.  Actual  levels  are  a function  of  not 
only  peak  level  but  also  the  frequency  and  duration  of  the 
transient.  Threshold  levels  vary  greatly  for  different 
types  of  components.  Wide  variations  In  threshold  levels 
can  exist  even  for  devices  of  the  same  kind  from  one 
manufacturer,  produced  on  a common  production  run. 


When  damage  occurs  It  almost  invariably  causes 
upset.  However,  damage  Is  separated  from  upset  as  a 
category  for  several  reasons.  Damage  Is,  from  many  points 
of  view,  more  serious  than  upset.  Damage  requires  that 
service  personnel  be  summoned  to  run  tests  and  diagnostics 
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Another  reason  damage  Is  considered  separately  Is 
that  hardening  against  damage  Is  much  less  expensive  than 
hardening  against  upset.  The  shielding  and  other  protective 
measures  used  for  hardening  are  difficult  to  apply  to  a 
degree  adequate  for  protection  against  upset#  which  occurs 
at  levels  more  than  an  order  of  magnitude  lower  than  for 
damage.  If  a system's  mission  does  not  require  continuous 
real-time  operation#  then  the  upset  problem  can  frequently 
be  handled  more  cost-effectively  through  fault-toleration 
procedures . 

The  primary  objective  of  HEMP  hardening  generally 
Is  to  attempt  to  block  the  energy  present  In  the  HEMP 
environment  outside  the  system  from  getting  Into  the 
electronics.  If  this  effort  Is  not  adequate#  the 
alternative  Is  to  make  the  electronics  resistant  to 
transients  or  to  make  the  system  fault  tolerant. 

Protecting  a typical  electronic  circuit  against 
damage  requires#  as  a rule-of-thumb#  about  60  dB  of 
shielding  effectiveness  between  the  external  environment  and 
the  electronics.  To  protect  against  upset#  100  dB  Is 
required.  Greater  levels  of  protection  are  usually  required 
for  cables  and  other  conductors  which  penetrate  the  shielded 
envl ronment . 


Systems  or  subsystems  are  normally  contained  In  one 
or  more  levels  of  shielding.  The  first  level  of  shielding 
(first  shield  boundary)  Is  the  overall  inclosurc#  either  a 
building#  electronics  shelter#  or  equipment  box.  Additional 
levels  of  shielding  are  provided  If  within  the  overall 
structure  the  equipment  Is  Installed  In  effective  shielded 
cabinets  or  boxes.  Normal  rack  mounting  of  equipment  does 
not  qualify  as  an  effective  means  of  shielding. 

Common  HEMP  terminology  labels  the  external  HEMP 
environment  as  zone  0.  The  area  Inclosed  by  the  first 
shield  boundary  Is  zone  1.  The  first  shield  boundary  Is  the 
zone  0/1  boundary.  Additional  shield  boundaries  within  zone 
1 may  Inclose  one  or  more  zone  2 levels#  and  within  them 
zone  3 levels#  and  so  forth.  This  Is  shown  conceptually  In 
figure  1. 


SHIELD  1 


Figure  1.  Environmental  zones  in  a complex  facility. 


Common  electronics  shelters#  for  example#  that  are 
constructed  of  corrugated  steel  or  aluminum  with  seams 
welded  or  riveted#  can  provide  up  to  60  dB  of  shielding 
effectiveness.  If  this  figure  Is  met#  no  further  protection 
would  be  needed  for  damage  hardening.  Additional  hardening 
would  still  be  needed#  of  course#  to  provide  the  100  dB 
required  for  upset  protection.  But  even  If  damage  Is  the 
only  concern#  an  electronics  shelter  will  not  provide  the 
needed  60  dB  of  protection  unless  It  Is  well  constructed  and 
all  potential  factors  that  can  degrade  the  shielding 
effectiveness  of  the  shelter  are  properly  handled.  Any  of 
many  possible  types  of  flaws  In  the  overall  shield  can 
drastically  reduce  the  shielding  effectiveness.  One 
unshielded  cable#  without  terminal  protection  devices 
(TPD's)#  that  penetrates  a shield  boundary#  can  effectively 
negate  all  the  shielding  effectiveness  otherwise  provided. 
Actual  military  electronics  shelters  have  been  seen  to  have 
less  than  20  dB  of  shielding  effectiveness.  One  Important 
factor  to  consider  Is  that  even  If  a system  environment  Is 
designed  and  constructed  to  have  a high  shielding 
effectiveness#  after  normal  operation  over  a period  of  time 
the  shielding  measures  employed  may  degrade.  This  Is 
particularly  true  for  mobile  systems. 
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It  should  be  stressed  that  the  rule-of-thumb 
shielding  figures  given  above  are  gross  estimates.  Actual 
overall  attenuation  requirements  for  a system  may  be 
substantially  higher  or  lower.  For  example#  a moderately 
long  run  of  unshielded  cable#  entering  a system  shelter#  can 
couple  a great  amount  of  energy  Into  the  system#  requiring 
surge  suppression  and  filter  protection  at  the  cable 
entrance  point  much  greater  than  the  60/100-dB  values. 

Factors  that  can  degrade  the  shielding 
effectiveness  of  a shield  can  be  divided  Into  two 
categories:  apertures  and  penetrators.  An  aperture  Is  any 
opening  In  the  shield  that  allows  electromagnetic  radiation 
to  penetrate  the  shielded  environment.  Common  examples  of 
apertures  are  windows#  doors#  and  vents.  Special  shielding 
measures  must  be  applied  to  all  apertures  to  avoid  serious 
degradation  of  the  potential  shielding  effectiveness  of  the 
shield  boundary.  Often  windows  can  be  eliminated 
altogether.  Vents  should  be  covered  with  good  electrically 
conductive  grates  that  are  well  bonded  electrically  to  the 
overall  shield  boundary.  Doors  should  be  fitted  with 
electrically  conductive  gasketing  around  the  edges  so  as  to 
provide  a good  continuous  perimeter  seal  when  the  door  Is 
closed.  Standard  operating  procedures  should  call  for  doors 
to  be  closed  except  for  personnel  entering  and  exiting. 

A penetrator  Is  any  conductive  medium  that 
penetrates  the  shield  boundary.  Common  penetrators  Include 
pipes#  power  lines#  ground  conductors#  antennas#  telephone 
lines#  and  other  signal  conductors.  Any  antenna  or 
unshielded  run  of  pipe  or  cable  acts  like  a highly  effective 
antenna  which  can  couple  large  amounts  of  HEMP  energy  Into 
the  shielded  environment.  Therefore#  external  cables  should 
be  well  shielded  where  possible.  The  shields  should  be 
peripherally  bonded  to  the  connectors  and  the  connectors 
should'  be  grounded  to  the  outside  of  the  shield  boundary 
which  the  cables  penetrate.  All  conductors  should  have 
TPD's  applied  where  they  enter  the  shielded  environment. 
TPD's  Include  surge-suppression  devices  and  filters. 

The  grounding  system  employed  Is  also  of  great 
Importance  In  assuring  the  maximum  benefit  from  system 
shielding.  A good  earth  ground  must  be  provided.  All 
exteriors  of  shield  boundaries  should  be  Interconnected  and 
connected  to  earth  ground  with  as  short  a. path  as  possible. 
The  system  electronics  should  be  Interconnected  In  an 
orderly  pattern  to  a floating  system  ground  that  is  In  turn 
connected  to  the  shield  ground  and  to  earth  ground  (see 
sect.  6.2  and  7.2). 
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To  harden  against  upset/  multiple  levels  of 
shielding  are  required  to  provide  an  overall  shielding 
effectiveness  of  100  dB.  Instead  of  100  dB  of  shielding/ 
which  Is  difficult  to  obtain/  transient-resistant  circuitry 
and  fault-tolerant  measures  may  be  employed. 

Most  computer  systems  employ  fault  tolerance  to 
some  extent  to  assure  that  the  equipment  performs  adequately 

[under  normal  environments.  The  normal  measures  are  useful 
for  HEMP-upset  protection  but  are  typically  not  nearly 
adequate.  Fault-tolerance  measures  can  be  Implemented  In 
hardware  or  software/  as  standard  operating  procedures/  or 
as  combinations  of  these.  Common  fault-tolerance  measures 
I ncl ude 

hardware  redundancy, 

error  detection/correction, 

process  redundancy, 

plausibility  checks, 

traps, 

timers, 

checkpoint  rollback,  and 
Instruction  retry. 
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Once  a system  Is  built  hard  to  HEMP,  the  job  is  not 
complete.  To  Insure  a continuing  HEMP  hardness, 
requirements  must  exist  for  proper  maintenance  for  all 
hardening  measures.  Periodic  testing  might  be  necessary  as 
well. 


3.3  Impact  of  Damage  and  Upset  on  System 
Performance  and  Mission 


Tables  III  and  IV  summarize  the  effects  on  system 
performance  caused  by  logical  classes  of  damage  and  upset. 
These  classes  reflect  problems  that  can  occur  if  less  than 
total  HEMP  hardening  is  Incorporated  In  the  system.  Damage 
Is  broken  up  Into  three  classes.  Each  Involves  failure  of 
either  a circuit  or  a complete  subsystem  or  peripheral  due 
to  damage  of  an  Individual  component.  The  three  classes 
differ  In  (1)  whether  or  not  the  lost  circuit  or  subsystem 
Is  redundant  and  (2)  whether  or  not  the  circuit  or  subsystem 
Is  critical  to  the  system  function  of  Interest. 


i 
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TABLE  III.  IMPACT  OF  DAMAGE  ON  SYSTEM  PERFORMANCE 


Problem 

Impact 

Damage  1 n 

system-critical. 

nonredundant 

subsystem/ per  1 pheral/cl rcul t 

Total  loss  of  system  until 
failed  element  Is  Isolated 
and  repa 1 red/ rep  1 aced 

Damage  1 n 

nonsystem-cr 1 tlcal, 
nonredundant 

subsystem/ per Ipheral/cl rcul t 

Partial  loss  of  system 
capability  until  failed 
element  Is  Isolated 
and  repal red/replaced 

Damage  In 

redundant 

subsystem/per Ipheral/cl rcul t 

Partial  or  total  loss  of 
ability  to  withstand 
subsequent  failures  until 
failed  element  Is  Isolated 
and  repaired/replaced 

TABLE  IV.  IMPACT 

OF  UPSET  ON  SYSTEM  PERFORMANCE 

Problem 

Impact 

Undetected  upset 

Incorrect  system  performance; 
no  solution 

Detected,  uncorrectable 

upset  Loss  of  system/subsystem/ 

peripheral;  no  solution 

Detected,  automat  1 ca 1 1 y 
correctable  upset 

Degraded  system  throughput, 
slow  system  response 

Detected,  manually 
correctable  upset 

Loss  of  system/ subsystem/ 
peripheral  until  operator 
restores  Information  or 
hardware  states  to 
pre-upset  condition  and 
restarts  Interrupted 
actlvl ty 

I 
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Redundancy/  as  used  here/  refers  to  the  existence 
of  a (functionally  equivalent  and  available)  backup 
replacement  for  the  lost  circuit  or  subsystem.  A backup/  If 
It  exists,  may  be  automatically  switched  In  or  may  require 
operator  Intervention  to  be  brought  on-line.  The  backup  may 
be  a hot  backup  (powered-up  and  operating)/  warm  backup 
(powered-up  but  not  in  use)/  or  cold  backup  ( powered -down/ 
possibly  physically  disconnected). 

The  first  damage  class  concerns  the  loss  of  a 
circuit  or  subsystem  which  Is  critical  to  the  system 
operation  and  for  which  no  backup  unit  exists.  This  Is  the 
most  serious  damage  class.  The  most  common  example  Is  loss 
of  all  or  part  of  the  central  processor  unit,  memory/  or 
main  Interface  bus.  In  most  systems  no  redundancy  exists 
for  such  units.  Other  examples  might  exist  for  specific 
systems  such  as  the  loss  of  the  only  magnetic  tape  drive  or 
the  loss  of  a disk  controller  that  controls  one  or  more  key 
disk  drives. 

The  result  of  this  type  of  failure  Is  that  the 
entire  system  Is  lost  until  repairs  can  be  made.  The 
repairs  might  consume  anywhere  from  several  minutes  to  many 
days.  Service  personnel  must  be  summoned  to  run  tests  and 
diagnostics  to  Isolate  the  failure.  Once  the  failure  is 
found/  the  faulty  components  or  circuit  boards  must  be 
repaired  or  replaced.  The  necessary  spare  parts  may  or  may 
not  be  readily  available.  Considerable  time  may  be  consumed 
obtaining  and  Installing  the  replacement  parts. 

The  second  damage  class  refers  to  the  loss  of  a 
circuit  or  subsystem  which  Is  not  critical  to  the  system 
operation  and  does  not  have  an  available  backup.  This  class 
Is  not  as  serious  as  the  previous.  An  example  might  be  the 
loss  of  the  system  tape  drives  where  those  tape  drives  are 
not  required  for  normal  operation.  They  may  only  be  used 
for  installation  of  new  software  and/or  for  generation  of 
backup  copies  of  software  and  data.  The  result  of  the 
failure  Is  that  only  certain  system  capabilities  are  lost. 
The  system's  primary  mission  can  still  be  performed.  The 
same  repair  procedure  as  outlined  for  the  previous  class  Is 
required  to  bring  the  system  up  to  full  operation. 

The  third  damage  class  Is  perhaps  the  least  serious 
and  Involves  the  loss  of  a redundant  circuit  or  subsystem. 
Since  a backup  exists,  the  system  can  continue  to  function 
normally.  The  result  of  the  failure  Is  that  the  system  has 
lost  part  or  all  of  Its  ability  to  withstand  future 
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(I.e.,  penetrators  and  apertures)  in  order  to  block 
substantial  HEMP  energy  from  entering  the  system 
environment.  Ail  that  can  be  done  should  be  done  to  take 
full  advantage  of  the  presence  of  any  shield  boundaries. 

Shielding  of  external  cables  which  penetrate  the 
zone  0/1  boundary  can  be  an  effective  means  of  reducing 
unwanted  transients.  This  technique  is  more  expensive  than 
Installation  of  TPD's  for  long  cables  and  often  the  designer 
has  no  control  over  this  area.  Commercial  power  and 
telephone  service  are  examples  where  cable  modifications  are 
usually  Impossible. 

A desirable  measure  which  can  provide  good 
Isolation  from  power-line  transients  Is  Implementation  of  a 
design  whereby  the  system  power  Is  Isolated  from  the 
external  power.  This  could  Involve  using  battery  power  as 
the  direct  source  of  system  power  while  using  the  externally 
supplied  power  to  charge  the  battery  system.  Effective 
Isolation  between  the  two  parts  of  the  power-supply  system 
Is  obtainable  and  is  commonly  provided  In  commercially 
available  unlnterruptable  power  supply  system  designs.  The 
cost  of  such  a system  Is  commonly  considered  too  great  for 
many  uses,  but  the  benefits  for  HEMP  protection  are  quite 
good.  Such  a system  Is  highly  desirable  even  for  normal 
operation  of  ADPE  In  a non-HEMP  environment. 

It  can  also  be  quite  effective  to  shield  Intrasite 
cables/  which  run  between  system  components.  Here  It  Is 
usually  cost-effective  to  employ  shielding/  as  cable  runs 
are  typically  short  between  ADP  elements.  Shielding  Is 
competitive  with  terminal  protection  for  Intrasite  cabling. 
The  cost  benefits  of  protecting  Intrasite  cabling  Increase 
dramatically  If  similar  protection  Is  provided  consistently 
to  all  such  cables,  and  especially  If  this  cabling  connects 
equipment  within  a further  level  of  shielding. 

The  rapidly  developing  technology  of  fiber-optic 
cabling  can  be  extremely  effective  for  eliminating 
propagation  of  HEMP  transients  between  ADP  system  elements. 
A fiber-optic  link  Is  a good  solution  for  an  intrasite 
cabling  application  where  problems  are  expected/  as  such  a 
link  provides  total  Immunity  to  HEMP-Induced  transients. 

All  unnecessary  apertures  should  be  removed 
(sealed)  from  the  overall  system  Inclosure.  If  the  system 
0/1  boundary  provides  any  reasonable  level  of  shielding/  It 
Is  highly  cost-effective  to  treat  all  apertures.  Doors 
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should  be  properly  fitted  with  radio  frequency  Interference 
(RFI ) gasketing  and  should  remain  closed  when  possible.  The 
degrading  effects  of  an  open  door  are  so  significant  that 
for  systems  where  a door  must  be  opened  often,  the  designer 
should  consider  Installation  of  a double-door/vestl bi  s type 
of  arrangement.  Vents  and  other  apertures  which  must  remain 
open  can  be  fitted  with  honeycomb  grills  or  similar  shields 
which  will  help  to  minimize  penetration  of  HEMP  energy. 

A proper  overall  grounding  scheme  Is  a necessary 
complement  to  the  other  faul t-avol dance  measures.  A good 
grounding  system  will  serve  to  assure  maximum  benefit  from 
system  shielding  by  providing  an  easy  and  direct  path  by 
which  transient  energy  can  be  dissipated.  Further,  a 
si ngle-pol nt-system  grounding  scheme  Is  highly  desirable  for 
enhancing  HEMP  survivability. 

During  the  design  phase,  the  designer  should 
consider  using  transient-resistant  circuit  designs. 
Wherever  no  additional  cost  Is  Incurred,  such  measures 
should  by  all  means  be  employed.  Applying  such  measures 
where  there  Is  limited  Increased  cost  Is  further  recommended 
for  situations  Involving  (1)  circuits  which  are  critical  to 
the  system  mission,  (2)  components  and  circuits  which  are 
electrically  near  HEMP  ports  of  entry,  and  (3)  components 
which  are  particularly  sensitive  to  HEMP-Induced 
transients.  Selective  Implementation  of  transient-resistant 
circuit  designs  Is  more  cost-effective  than  later 
application  of  fault-tolerance  measures  except  where  large 
cost  Increases  are  Involved. 

Table  V summarizes  the  fault-avoidance  measures 
discussed  above  and  recommended  for  general  systems  which 
Include  significant  amounts  of  ADP  equipment.  They  are 
categorized  as  either  required,  desired,  or  providing  an 
extra  margin  of  protection.  All  these  measures  are  relevant 
to  both  HEMP  damage  and  upset  protection. 


3.6  Design  Guidelines  for  Fault  Tolerance 

Fault  tolerance  Is  an  arrangement  permitting  a 
system,  subsystem,  or  circuit  to  continue  to  operate  In  the 
expected  manner  In  spite  of  a fault.  Electrical  circuitry, 
software,  or  operating  procedures  are  specifically  designed 
or  supplemented  such  that  faults  are  detected  and  are  either 
Ignored  or  corrected.  The  term  "expected  manner"  Is  used  In 
the  definition  of  fault  tolerance  Instead  of  "correct 
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TABLE  V.  SUMMARY  OF  HEMP  HARDENING  MEASURES  RECOMMENDED 
FOR  FAULT  AVOIDANCE  FOR  GENERAL  ADPE  SYSTEMS 


Requl red 


Des I red 


Extra  margl n 
of  protection 


Good  zone  0/1  shield 
boundary 


Good  zone  1/2  shield 
boundary 


Additional  shield 
boundaries 


Surge  suppression  & 
f I lterlng  appl led  to 
all  zone  0/1 
boundary  penetrators 
Including  all  power, 
signal,  & telephone 
1 1 nes 


Shleldl ng  of  al 1 
external  cables 
which  penetrate 
zone  0/1  boundary 


Two-door/vestl bule 
arrangement 


Shielding  of 
I ntrasl te  cables, 
especl al ly  where 
system  has  good 
zone  1/2  shield 
boundary 


Al  1 unnecessary 
apertures  avoided 
(sealed);  proper 
Instal latlons  of  al 1 
entry  panels,  etc 


GrI 1 ls/shlelds 
Installed  on  all 
vents 


RFI  gasketing  on 
all  doors;  doors 
shut  as  much  as 
possible 


SI ngle-pol nt -system 
grounding  scheme 


TPD's  appl led  to 
I ntrasl te  cabl I ng 
especially  where 
system  has  good 
zone  1/2  shield 
boundary 


Trans  I ent-res I s tant 
cl rcul try 


Fiber-optic  links 
employed  for 
1 ntrasl te  cabl I ng 


Two-door/vestl bule 
arrangement  where 
doors  are  open  often 


Power  system 
Isolated  from 
external  power 
supply 


Proper  overall 
system  ground  scheme 


behavior."  Correctness  of  an  Information  process  Is  beyond 
the  scope  of  fault  tolerance  as  used  here,  as  It  Involves 
the  adequacy  of  the  specifications  made  by  the  originator. 
For  example,  the  design  of  an  unsuitable  process  or 
algorithm  by  the  originator  or  programmer  can  yield  expected 
behavior  that  does  not  meet  the  originator's  Intended  goal. 


Fault-tolerance  measures  are  an  effective  means  of 
dealing  with  the  HEMP-upset  problem.  They  are  not  a 
realistic  approach  to  the  HEMP-damage  problem.  Typically 
the  best  approach  to  protecting  against  upset  Is 
implementation  of  a comprehensive  fault-avoidance  scheme 
supplemented  with  fault-tolerance  measures  where  needed. 
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Any  system  which  Includes  significant  amounts  of 
ADP  equipment  and  does  not  Include  all  those  faul t-avol dance 
measures  listed  as  required  and  desired  In  section  3.5  must 
employ  fault  tolerance  In  order  to  protect  against 
HEMP-1 nduced  upset.  All  computer  systems  Include  some  fault 
tolerance  to  enable  the  system  to  operate  through  normal 
problems.  Usually  much  more  Is  required  than  those  normal 
fault-tolerance  measures  used  to  prevent  upsets  caused  by 
non-HEMP  causes.  Fault  tolerance  cannot  be  the  sole 
protection  scheme.  Fault  tolerance  must  supplement  a good 
Implementation  of  fault-avoidance  measures. 

For  HEMP-upset  protection#  the  recommended  fault 
tolerance  should  Include#  as  a minimum#  error-checkl ng 
schemes  for  all  stored  Information  (Including  memory  and  all 
storage  devices)  and  all  data  transfers#  both  Internal  and 
external  to  the  system.  Duplicate  copies  of  all  critical 
Information  must  be  maintained  on  HEMP-hard  storage  media. 

A fault  Is  defined  as  any  abnormal  condition  of 
hardware#  software#  or  data  that  may  cause  a deviation  of 
the  Information-processing  behavior  from  the  expected  and 
desired  sequence.  A fault  may  be  due  to  a component  failure 
(damage)  or  may  be  associated  with  any  of  the  various  types 
of  upset  conditions.  The  term  fault  as  used  here  refers  to 
physical  faults  only.  Man-made  faults  are  not  Included. 

All  system  parts  are  subject  to  faults.  This 
Includes  hardware  elements#  programs#  microprograms#  data# 
Input  and  output  signals#  Inter-system  and  Intra-system 
communications#  and  man-machine  communications. 

The  occurrence  of  a fault  can  result  In  either 
partial  or  total  loss  of  the  system  or  function  unless 
provisions  exist  to  cause  a return  to  the  expected 
behavior. 

Faults  are  caused  either  by  (1)  permanent  failures 
of  hardware  components#  (2)  temporary  malfunctions  of 
components#  (3)  external  Interference  with  system  operation# 
and  (4)  human  mistakes.  This  document  Is  only  concerned 
with  faults  caused  by  HEMP. 

Fault  tolerance  Is  a specialized  field  of  study  In 
the  Information-processing  arena  and  has  been  growing 
quickly  In  recent  years  because  of  the  movement  of  computer 
processing  Into  numerous  new  applications#  especially 
critical  applications  Involving  strategic  defense  and 


life-support  missions.  While  the  normal  reliability  of 
components  used  In  ADPE  has  improved  by  orders  of  magnitude/ 
this  use  of  AOPE  In  critical  applications  has  caused 
Interest  In  fault  tolerance  to  grow  and  surface. 

For  a more  detailed  discussion  of  fault-tolerance 
and  fault-tolerance  measures  for  HEMP-upset  protection/  the 
reader  is  directed  to  the  selected  bibliography. 


4.  ASSUMPTIONS  CONCERNING  DAS3  CONSTRUCTION  AND 

CONFIGURATION 

This  section  describes  the  assumptions  made  concerning 
the  DAS3  system  for  purposes  of  this  HEMP  assessment. 
Primarily/  the  assumptions  are  concerned  with  the  physical 
makeup  of  the  system  and  how  It  Is  to  be  configured  for 
operation.  Besides  the  specifications  and  the  published 
works  l<"9  referred  to#  the  following  unpublished 
documentation  was  also  used: 

4TM9-2330-271-14,  Operator's,  Organizational,  Direct 
Support  and  General  Support  Maintenance  Manual,  Semitrailer, 
Van:  Electronic  10-Ton,  4 Wheel,  Including  XM913  (12  May 
1972),  Including  updates  through  Change  No.  2 (26  Nov  1976). 

sTM5-6115-365-15,  Organizational,  DS,  GS  and  Depot 
Maintenance  Manual  Including  Repair  Parts  and  Special  Tools 
List,  Generator  Sets,  Gasoline  and  Diesel  Engine  Driven, 
Trailer  Mounted,  Including  PU  406/M  (May  1966). 

6TM5-6115-465-12,  Operator  and  Organizational  Maintenance 
Manual,  Generator  Set,  Diesel  Engine  Driven,  Tactical  Skid 
Mtd.  30  kW,  3 Phase,  4 Wire,  120/208  and  240/416  Volts, 
Including  MEP-005A  (January  1975),  including  updates  through 
Change  No.  2 (14  February  1977). 

'TM5-6115-465-24P,  Technical  Manual,  Organizational, 
Intermediate  (Field)  (Direct  Support  and  General  Support) 
and  Depot  Maintenance  Repair  Parts  and  Special  Tools  List, 
Generator  Set,  Diesel  Engine  Driven,  Tactical  Skid  Mtd.  30 
kW,  3 Phase,  4 Wire,  120/208  and  240/416  Volts,  Including 
MEP-005A  (February  1977). 

0TM5-61 15-4 65-34,  Intermediate  (Field)  (Direct  and 
General  Support)  and  Depot  Level  Maintenance  Manual, 
Generator  Set,  Diesel  Engine  Driven,  Tactical  Skid  Mtd.  30 
kW,  3 Phase,  4 Wire,  120/208  and  240/416  Volts,  Including 
MEP-005A  (January  1975). 

Report  of  Test  on  Radio  Frequency  Attenuation  of  Trailer 
XM703,  Miller  Trailers,  Inc.,  Electronic  Communications, 
Inc.,  4-1160  (6  July  1965). 
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XM971  Semitrailer  Van  engineering  drawing  package; 
part  Included  In  DAS3  RFP  and  part  supplied  by  Otto 
Pller,  Army  Tank  Automotive  Materiel  Readiness 
Command  ( TAR COM) . 

TM5 -6 115-365-15,  draft,  supplied  17  duly  1978  by 
William  Olvlns,  Army  Troop  Support  and  Aviation 
Materiel  Readiness  Command  (TSARCOM);  chapter 
25;  Generator  Set,  PU  406B/M;  chapter  28;  Power 
Plant,  Electric,  Trailer  Mounted,  AN/MJQ-10A. 

The  XM703  RFI  test  report9  relates  to  equipment  which  Is 
similar  but  not  Identical  to  equipment  associated  with  the 
DAS3  system.  Numerous  other  documents.  Including  military 
standards  and  specifications,  were  examined  but  are  not 
Included  as  references. 

The  physical  nature  of  the  DAS3  system  Is  based  on  the 
above-cited  documents  as  well  as  conversations  with 
representatives  of  the  responsible  Army  agencies.  Including 
TARCOM,  TSARCOM,  MERADCOM,  Tobyhanna  Army  Depot,  and  TACMIS 
PMO.  In  addition,  on-site  Inspections  were  made  of  several 
standard  MEP-005A  generator  sets  and  prototype  XM971 
semitrailer  vans. 

Knowledge  of  the  DAS3  ADPE  Is  limited  to  the  functional 
description  and  performance  sped flcat Ions. 2 It  Is  assumed 
that  up  to  eight  computer  terminals  (KVDT's)  might  be 
outside  the  DAS3  van  and  connected  by  an  unknown  type  of 
cabling  through  the  van  signal -entry  panel  to  the  central 
system  ADPE.  It  Is  further  assumed  that  WD-1  field  wire  of 
undetermined  lengths  will  run  to  the  van  signal-entry  panel 
to  provide  service  to  a field  phone  Inside  the  van. 

The  XM971  semitrailer  van  (defined  by  the  engineering 
drawing  package)  to  be  used  Is  a modified  form  of  the  common 
XM913  van.3  The  XM971,  provided  for  DAS3,  differs  from  the 
XM913  In  the  following  ways. 


"Specification  for  the  Decentralized  Automated  Service 
Support  System  DAS3,  Tactical  Management  Information  Systems 
Project  Management  Office  (February  1978). 

3EMP  Engineering  and  Design  Principles,  Bell  Telephone 
Laboratories  (1975). 

Report  of  Test  on  Radio  Frequency  Attenuation  of  Trailer 
XM703,  Miller  Trailers,  Inc.,  Electronic  Communications, 
Inc.,  4-1160  (6  July  1965). 
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The  curb  side  door  Is  relocated  forward. 

There  are  no  door  vents. 

Conductive  mesh  gasketing  Is  Installed  around  all 
doors. 

No  Inside  walls  or  finished  floor  Is  Installed. 

No  entry  panels  are  Installed  for  power  or  signal 
cable  entry  to  the  van. 

The  DAS3  ADPE  contractor  will  Install  the  power  and 
signal-entry  panels  and  al r-condl tlonl ng  units,  and  finish 
the  Interior  of  the  van.  An  unusual  feature  of  the  XM971 
van,  which  Is  useful  for  HEMP  shielding.  Is  the 
0.135-In. -thick  aluminum  floor. 

The  MEP  to  be  employed  Is  assumed  to  conform  to  the 
description  In  various  Army  Manuals5’8  and  the  draft 
TM5-6 115-36 5-15,  previously  mentioned.  The  two  generator 
units  will  be  electrically  connected  In  the  AN/MJQ-10A 
configuration  through  a switch  box  as  described  In  the  draft 
TM,  chapter  28.  Commercial  power  is  a planned  alternative 
power  source. 


sTM5-6115-365-15,  Organizational,  DS,  GS  and  Depot 
Maintenance  Manual  Including  Repair  Parts  and  Special  Tools 
List,  Generator  Sets,  Gasoline  and  Diesel  Engine  Driven, 
Trailer  Mounted,  Including  PU  406/M  (May  1966). 

eTM5-6115-465-12,  Operator  and  Organizational  Maintenance 
Manual,  Generator  Set,  Diesel  Engine  Driven,  Tactical  Skid 
Mtd.  30  kW,  3 Phase,  4 Wire,  120/208  and  240/416  Volts, 
Including  MEP-005A  (January  1975),  Including  updates  through 
Change  No.  2 (14  February  1977). 

7TM5-6115-465-24P,  Technical  Manual,  Organizational, 
Intermediate  (Field)  (Direct  Support  and  General  Support) 
and  Depot  Maintenance  Repair  Parts  and  Special  Tools  List, 
Generator  Set,  Diesel  Engine  Orlven,  Tactical  Skid  Mtd.  30 
kW,  3 Phase,  4 Wire,  120/208  and  240/416  Volts,  Including 
MEP-005A  (February  1977). 

8TM5-6115-465-34,  Intermediate  (Field)  (Direct  and 
General  Support)  and  Depot  Level  Maintenance  Manual, 
Generator  Set,  Diesel  Engine  Driven,  Tactical  Skid  Mtd.  30 
kW,  3 Phase,  4 Wire,  120/208  and  240/416  Volts,  Including 
MEP-005A  (January  1975). 
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The  actual  power  cables  to  be  used  and  the  cable  routing 
configuration  between  the  MEP  and  the  van  is  uncertain.  All 
cables.  In  the  selection  list  provided  with  the  0AS3  RFP/ 
are  unshielded.  A minimum  of  40  m Is  specified  for  the 
distance  of  the  MEP  from  the  van. 

The  HEMP  assessment  assumes  that  the  requirements 
Included  In  the  Specifications  for  DAS32  will  be  met  by  the 
selected  contractor.  All  EMI/  EMC/  and  general 
electromagnetic  shielding  requirements  are  particularly 
Important.  Other  specifications2  considered  particularly 
relevant  to  HEMP  damage  and  upset  protection  are  the 
fol lowl ng : 

page  15/  section  3/  subsection  3. 1.5. 4: 

"a.  Protected  Circuits.  Voltage  surge  suppression 
devices  shall  be  provided  on  each  data/voice 
circuit  to  protect  equipment  and  personnel  against 
lightning  and  electromagnetic  pulses.  EMI 
suppression  devices  shall  be  provided  to  meet 
requirements  of  paragraph  3.3.2." 

page  37/  section  3/  subsection  3. 3.9.1: 

".  . . Power  lines  shall  be  filtered  on  all  three 
phases  and  neutral/  using  appropriate  EMI 
suppression  filters  having  attenuation 

characteristics  greater  than  60dB  over  the 
frequency  range  of  14kHz  to  1GHz." 

page  37/  section  3/  subsection  3. 3.9. 3: 

"Power  Protection.  If  required/  appropriate 
devices  shall  be  provided  to  completely  protect  all 
variations  In  prime  power  which  are  beyond  the 
limits  as  contained  In  Ml L-STD-1332  for  the  type  of 
power  used.  The  system  shall  also  be  protected 
against  a power  outage  to  preclude  damage  to  the 
equipment." 

page  55/  section  3 attachment/  subsection  1.3. 3. 9: 
"Power  Fall  Protection.  Upon  sensing  a change  in 
voltage  or  line  transient  which  Is  unacceptable  to 
the  operatable  range  of  the  equipment/  the  system 
shall  generate  an  Interrupt  on  the  highest  priority 
level.  Sufficient  filtering  shall  exist  within 


2Speclf (cation  for  the  Decentralized  Automated  Service 
Support  System  DAS3/  Tactical  Management  Information  Systems 
Project  Management  Office  (February  1978). 
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power  supplies  to  permit  the  computer  to  save  all 
data  necessary  to  permit  the  operator  to  Initiate  a 
restart  to  continue  program  execution  at  the  point 
at  which  the  Interrupt  occurred  or  at  the  last 
available  check  point." 

page  49#  section  3 attachment#  subsection  1.2.2. 1: 
"h.  Shall  prevent  application  programs  from 
executing  privileged  Instructions." 

page  49#  section  3 attachment#  subsection  1.2. 2.1: 
"I.  Shall  provide  detection  of  defective  memory 
segments  and  a procedure  for  processing  user 
programs  In  the  remaining  memory  segments." 

page  49#  section  3 attachment#  subsection  1.2. 2.1: 
"j.  Shall  provide  detection  and  bypassing  of 
defective  disk  and  tape  areas." 

page  54#  section  3 attachment#  subsection  1.3. 3.1: 
"Hardware  facilities  shall  provide  memory 
protection  capability." 

page  62#  section  3 attachment#  subsection  1.3. 4. 7.1: 
"Error  detection  provided  by  the  hardware." 


5.  LIMITATIONS  OF  HEMP  ASSESSMENT 

The  preliminary  nature  of  the  results  of  this  HEMP 
assessment  Is  due  to  several  limitations.  These  limitations 
are  Cl)  lack  of  specific  Information  about  the  ADPE  and 
Installation  procedures#  (2)  lack  of  definition  of  final 
type  and  configuration  for  power  and  signal  cables#  and 
(3)  lack  of  experimental  data  on  HEMP  energy  likely  to  be 
coupled  to  system  cables  and  likely  to  penetrate  into  the 
Inner  van  environment  (zone  1). 

The  confidence  of  the  predicted  HEMP  survivability  of 
the  ADPE  to  damage  and  upset  cannot  be  Improved  unless 
further  analysis  Is  performed  to  relieve  one  or  more  of 
these  limitations.  The  survivability  of  the  MEP  cannot  be 
predicted  based  on  the  Information  available  for  this 
study.  Testing  Is  necessary  for  determination  of  the  MEP 
survlvabl 1 1 ty. 

Knowledge  of  the  specific  ADPE  and  Installation 
procedures  Is  Important  for  several  reasons.  First#  the 


threshold  levels  at  which  damage  will  occur  In  AOPE  can  vary 
widely.  Only  after  examining  the  AOPE  circuit  schematics 
and  wiring  Interconnection  diagrams  can  one  more  accurately 
determine  actual  damage  threshold  levels.  At  minimum,  such 
Information  would  Insure  that  no  unusually  sensitive 
circuitry  exists. 

Second,  further  ADPE  and  Installation  Information  Is 
Important  In  order  to  allow  determination  of  how  rigorously 
the  specifications  stated  In  the  DAS3  RFP1*2  are  met.  Some 
of  the  specifications  do  not  relate  .directly  to  HEMP 
protection  but  are  useful  for  that  purpose.  Examination  of 
circuit  schematics,  wiring  diagrams,  and  Installation 
procedures  would  reveal  whether  protection  Is  provided  to 
the  degree  expected  by  this  Initial  HEMP  assessment. 

Third,  one  needs  to  know  the  exact  circuitry  which 
terminates  the  power  and  signal  cables  to  allow  more 
accurate  prediction  of  HEMP  energy  coupled  to  the  cables. 

Fourth,  examination  of  actual  fault-tolerance  procedures 
Is  necessary  to  assure  adequacy  of  the  DAS3  plan  for 
HEMP-upset  protection. 

The  lack  of  Information  concerning  type  and 
configuration  of  power  and  signal  cables  Is  a limitation 
because  this  Information  Is  essential  for  prediction  of  the 
HEMP  energy  coupled  to  these  cables.  With  specific 
Information  about  the  cables  and  the  circuitry  that 
terminates  these  cables  at  the  van  end,  HEMP  tools  can  be 
applied  to  greatly  enhance  the  accuracy  of  predicted  coupled 
energy  levels  and  frequencies. 

Testing  Is  always  needed  to  verify  the  adequacy  of  HEMP 
hardening  measures  and  predicted  HEMP  survivability 
conclusions.  This  Is  due  to  the  unfortuna*s  fact  that 
presently  available  HEMP  prediction  tools  have  not  been 
refined  to  a satisfactory  level  of  accuracy.  The  primary 
weakness  In  present  tools  Is  In  the  area  of  prediction  of 
coupling  between  the  HEMP  environment  and  penetrators.  For 


^FP,  Solicitation  No.  DAHC26-78-R-0001,  Automated  Data 
Processing  Equipment,  Decentralized  Automated  Service 
Support  System;  A Mobile,  Van-Mounted  Management  Information 
System  (17  May  1978). 

Specification  for  the  Decentralized  Automated  Service 
Support  System  DAS3,  Tactical  Management  Information  Systems 
Project  Management  Office  (February  1978). 


DAS3,  this  specifically  limits  the  prediction  of  coupling  to 
cables  external  to  the  van  and  to  cables  Internal  and 
external  to  the  MEP. 

For  DAS3,  a system-level  test,  where  the  system  or 
system  components  are  subjected  to  a simulated  HEMP 
environment.  Is  needed  If  a hlgh-confldence  conclusion  Is 
desired  or  If  any  survivability  statement  Is  desired  for  the 
MEP.  Either  a small-  or  moderate-ef for t test  could  be 
conducted  depending  on  the  thoroughness  and  accuracy 
required  (see  sect.  8). 


6.  RECOMMENDED  HARDENING  MEASURES 

The  hardening  measures  discussed  In  this  section  are 
considered  necessary,  in  addition  to  RFP  specifications,  for 
DAS3  survivability  to  HEMP.  The  predicted  survivability  of 
the  DAS3  ADPE  depends  on  proper  Implementation  of  all  these 
measures . 


6.1  TPD's  at  Power  and  Signal  Entry  Panels 

It  Is  essential  that  TPD's  be  Installed  on  all 
conductors  which  penetrate  the  XM971  van  walls.  This 
Includes  all  power  and  signal  cable  conductors  as  well  as 
any  other  conductors  associated  with  external  cable  runs. 
Ground  conductors  must  be  protected  just  as  conductors  which 
carry  power  and  signals. 

DAS3  RFP  specifications  contain  various 
requirements  for  transient  protection  as  discussed  In 
section  4.  The  specifications  Include  specific  requirements 
for  voltage-surge  suppression  on  each  data/voice  circuit  and 
filtering  on  power  conductors  (all  three  phases  and 
neutral).  Additional  terminal  protection  Is  likely  to  be 
required  £o  meet  the  other  more  general  transient  and 
power-fal lure  protection  requirements.  TPD's  which  are 
installed  to  meet  these  specifications  should  be  made  to 
withstand  expected  HEMP  levels  as  well. 

Ideally,  TPD's  (Including  filters,  surge 
suppressors,  and  other  devices)  should  be  Installed  directly 
at  entry  panels  on  the  external  side  of  the  van  wall. 
Grounding  of  such  devices  should  be  made  to  the  external 
surface  of  the  van  wall.  This  will  confine  transient 
currents  to  the  outside  surface  of  the  van  walls  because  of 
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the  "skin  effect"  principles.  One  publication10  provides 
the  following  example  HEMP  spark-gap  specification. 

(1)  Appl I cat lon--The  protector  will  be  used  on  an 
ac  power  line.  The  line  potential  shall  be 
120  Vrms  maximum/  60  Hz  ac,  with  a source 
Impedance  of  0.3  ohms. 

( 2 > dc  breakdown  voltage — 350  V minimum/  490  V 
maximum. 

(3)  Response  time — 4 ns  maximum  with  a voltage 

rate  of  rise  of  5 kV/ns  or  greater.  The 

response  time  Is  defined  as  the  time  of 

application  of  the  voltage  to  the  time  when 
the  gap  "fires"  and  the  voltage  across  it  no 
longer  Increases  (see  fig.  2). 

(4)  Transient  pulse — The  maximum  line  potential 
shall  be  specified  as  In  figure  3 with  a 
source  Impedance  of  6 ohms  minimum  and  a load 
Impedance  of  3 ohms  minimum  resistive. 

(5)  Extinguish  criteria — The  gap  shall  extinguish 

and  not  retrlp  more  than  once#  with  the  retrlp 

duration  not  to  exceed  one-half  cycle  of  the 

line  current,  when  Initiated  by  the  proper 
trigger  pulse. 

(6)  Operational  life — The  part  shall  conduct  10 
current  pulses  as  specified  from  the 
conditions  In  4.  In  addition  the  part  shall 
conduct  600  of  the  current  pulses  resulting 
from  these  conditions/  except  that  the 
transient  voltage  amplitude  is  halved. 

(7)  Isolation  resistance — 10  megohms  minimum. 

Particular  specifications  can  be  generated  for  DAS 3 
once  definite  Information  Is  available  concerning  actual 
external  power  and  signal  cables  and  electronic  circuits 
which  terminate  these  cables  at  the  entry  panels. 


10C.  H.  Hart  and  D.  F.  Higgins/  A Guide  to  the  Use  of 
Spark  Gaps  for  Electromagnetic  Pulse  (EMP)  Protection/ 
Joslyn  Electronic  Systems  (1973). 


Important  to  consider  In  selection  of  TPD's  for 
HEMP  protection  Is  that  the  TPD's  must  Cl)  react  very 
quickly  and  (2)  be  able  to  tolerate  large  voltage  levels  and 
energy  surges.  This  often  requires  the  use  of  a hybrid 
arrangement.  Including  a fast-acting  device  to  eliminate 
early  transient  energy  and  a high-energy  device  that  Is  able 
to  divert  large  amounts  of  total  energy. 

Detailed  discussions  of  TPD  selection  criteria  and 
suggested  sources  of  supply  can  be  found  in  chapter  7 of  EMP 
Engineering  and  Design  Principles,3 * * * *  sections  4.3  and  4.4  of 
EMP  Radiation  and  Protective  Techniques, 11  and  chapter  10  of 
the  DCS  Design  Practices  for  HEMP  Protection  (draft,  HDL), 
excerpts  of  which  are  being  furnished  to  TACMIS  PMO  with 
this  report. 


6.2  External  System  Ground 


To  enhance  HEMP  survivability,  the  DAS3  external 
ground  system  should  be  designed  to  meet  the  following 
criteria  In  addition  to  other  grounding  requirements  In  the 
RFP  specifications. 

(1)  The  number  of  connections  to  the  ground  system 
from  cable  shields,  entry  panels,  and  the  van  body  should  be 
kept  to  a minimum.  This  will  minimize  the  adverse  effects 
of  transients  Induced  on  ground  system  conductors. 

(2)  Ground  rods  should  be  placed  close  to  the 
system  to  minimize  the  length  of  ground  straps.  This  will 
minimize  the  level  of  transients  coupled  to  the  ground 
straps. 


(3)  Entry  panels  should  be  collocated.  If  this  Is 

not  practical,  ground  rods  should  be  located  directly  at 

each  entry  panel.  These  steps  will  decrease  the  possibility 

that  transients  Induced  on  power  and  signal  conductors  will 

travel  between  the  entry  panels  on  the  van  shell. 


3 EMP  Engineering 
Laboratories  (1975). 
nL.  W.  Ricketts, 


and  Design  Principles,  Bell  Telephone 


Radiation  and 
York  (1976). 


J. 

Protective 


E.  Bridges,  and  d.  Mtletta,  EMP 
Techniques,  John  Wiley  & Sons,  New 
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(4)  All  ground  straps  and  other  conductors  should 
be  at  as  low  an  Impedance  as  possible.  The  Intent  Is  to 
provide  transients  with  a lower  Impedance  path  to  ground 
than  to  the  cables  or  van  structure. 

6.5  Installation  of  Power  and  Signal  Entry  Panels 


The  power  and  signal  entry  panels  must  be  properly 
Installed  to  avoid  degrading  the  overall  shielding 
effectiveness  otherwise  provided  by  the  XM971  semitrailer 
van.  The  Intent  Is  to  avoid  providing  any  opening  through 
which  electromagnetic  radiation  can  penetrate  the  Inner  van 
environment.  The  entry  panels  as  Installed  should  provide 
60  dB  of  attenuation  to  the  HEMP  environment.  A detailed 
discussion  of  apertures  and  bonding  procedures  Is  provided 
by  Campl.12*13  Important  criteria  from  these  references  are 
described  below. 

The  basic  entry  panels  should  consist  of  a 
conductive  metallic  material.  The  panel  material  should  be 
the  same  as  that  of  the  mating  surface,  although  this  Is  not 
required.  Use  of  similar  materials  enhances  the  bonding 
properties  of  the  joint  and  the  resistance  to  electrolytic 
degradation  of  the  bond.13  No  unintentional  holes  or  gaps 
should  exist  In  the  panels. 

Any  unused  holes  In  the  panels  should  be  tightly 
sealed  with  metal  plates  or  caps  of  the  same  material  as  the 
surface  they  contact.  These  seals  may  be  welded,  riveted, 
bolted,  or  screwed  In  place,  as  desired.  Conductive 
gasketing12  Is  desired  for  other  than  welded  joints  when  the 
mating  surfaces  do  not  make  good  contact  over  the  entire 
mating  surface.  Gasketing  Is  also  recommended  for 
connecting  pieces  which  will  be  removed  for  service  or  other 
use.  All  mating  surfaces  should  be  sanded  bare.  Corrosion 
Inhibitors  should  be  applied  to  mating  surfaces  which  are 
subject  to  corrosion.13  This  should  not  be  necessary  where 
similar  materials  are  joined.  For  large  holes,  the  bolt, 
weld,  or  rtvet  spacing  should  be  a maximum  of  3 in.12  The 
pressure  applied  between  the  mating  surfaces  must  be  at 
least  20  psl  .12 


12Morrls  Campl,  Survey  and  Review  of  Aperture  Shielding 
for  EMP/RFI  Fields,  Harry  Diamond  Laboratories,  HDL-TM-78-25 
(December  1978). 

13Morrls  Campl,  Survey  and  Review  of  Building  Shielding  to 
Electromagnetic  Waves  from  EMP,  Harry  Diamond  Laboratories, 
HDL-TM-78-23  (November  1978). 
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Entry  panels  should  be  firmly  secured  to  van 
walls.  Mating  metal  surfaces  should  be  bare  and  must 
overlap.  Conductive  gasketing  is  recommended  for  uneven 
mating  surfaces  or  when  the  panels  are  expected  to  be 
removed  for  service  access.  Corrosion  Inhibitors  should  be 
considered  for  mating  surfaces  which  are  subject  to 
corrosion.  A maximum  3-In.  bolt  spacing  (or  distance 
between  rivets  or  weld  spots)  should  be  used.  Installation 
of  the  panels  should  be  tight  enough  to  compress  gasketing 
around  the  entire  perimeter  of  the  opening.  Mating  surfaces 
should  be  joined  with  a pressure  of  at  least  20  psi. 

6.4  Installation  of  Air  Conditioners  and  Vents 


Installation  of  air  conditioners  Into  the  XM971  van 
front  wall  could  degrade  the  potential  shielding 
effectiveness,  as  would  any  aperture  in  a shield  boundary. 
Installation  of  the  air  conditioners  should  be  In  a manner 
consistent  with  the  goal  of  60-dB  shielding  effectiveness 
for  the  overall  van  Inclosure  to  plane  waves  in  the 
frequency  range  from  10  kHz  to  1000  MHz.  This  requires 
elaboration  on  or  additions  to  Installation  specifications 
In  the  RFP  In  two  areas.  First,  no  gap  should  be  allowed 
around  the  periphery  where  the  air  conditioner  mounts  In  the 
van  wall.  Second,  electromagnetic  shielding  should  be 
placed  over  all  exhaust  and  intake  vents. 

The  joint  where  the  a! r-condl tloner  units  mate  with 
the  holes  In  the  van  front  wall  should  be  tightly  sealed  so 
as  to  Inhibit  the  leakage  of  electromagnetic  radiation  Into 
the  Inner  van  environment.  Since  the  air  conditioners  must 
be  removable  for  servicing  or  replacement  It  Is  presumed 
that  they  will  be  bolted  In  place.  A maximum  3-ln.  bolt 
spacing  should  be  used.  Conductive  gasketing12  should  be 
used  If  frequent  disassembly  Is  expected  or  if  mating 
surfaces  do  not  make  smooth  continuous  contact  around  the 
entire  periphery  of  the  opening.  When  the  gasketing  Is 
Installed  a positive  pressure  should  be  applied  to  It  so 
that  it  Is  compressed  around  the  entire  periphery  of  the 
opening. 


Screening  should  be  placed  over  all  vent  openings. 
Alternative  types  and  sources  acceptable  for  HEMP  shielding 
are  discussed  by  Campl ,12  A honeycomb  shield  is  probably  the 
best  choice,  as  the  following  excerpt  from  Campl 12 
I ndlcates: 


12Morrls  Campl,  Survey  and  Review  of  Aperture  Shielding 
for  EMP/RFI  Fields,  Harry  Diamond  Laboratories,  HDL-TM-78-25 
(December  1978). 
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"A? J Inlet  and/or  outlet  apertures  for  ventilation 
or  pressurization  should  be  designed  for  EMP  suppression. 
In  many  cases,  shielding  mesh  screens  Introduce  excessive 
air  resistance,  and  sometimes  greater  shielding 
effectiveness  may  be  needed  than  they  can  provide.  Although 
louvered  openings  are  generally  used  for  cooling  air 
circulation,  they  are  extremely  poor  for  EMP/RFI  Integrity 
because  of  their  long,  narrow  gaps.  If  good  shielding  or 
strength  Is  required,  but  weight  and  space  are  not  critical, 
honeycomb  panels  may  be  used.  The  honeycomb  attenuates 
fields  both  by  reflection  and  by  the  attenuation  properties 
of  waveguides  below  cutoff.  The  honeycomb  Is  essentially  a 
screen  of  waveguides,  and  Its  attenuation  is  a function  of 
the  cross-sectional  size  and  length  of  the  waveguides,  the 
number  of  waveguides  per  area  on  the  panel  face,  and  the 
material  of  which  the  honeycomb  Is  made.  For  example,  steel 
honeycomb  Is  very  effective  for  electric  field  shielding; 
attenuation  of  over  100  dB  can  be  readily  obtained  over  the 
entire  EMP  frequency  range.  For  comparable  magnetic  field 
attenuations,  thick  honeycomb  made  of  iron  or  magnetic 
stainless  steel  must  be  used." 

For  installation  of  honeycomb  shielding  over  vents, 
the  joint  between  the  shield  and  the  vent  should  make  a good 
electrical  bond. 

6.5  No  Additional  Apertures  or  Penetrators 


In  the  construction  and  assembly  of  DAS 3, 
additional  apertures  or  penetrators  should  be  avoided.  An 
untreated  or  improperly  Installed  aperture  or  penetratcr  can 
seriously  degrade  the  shielding  effectiveness  provided  by  a 
shield  boundary.  A van  shelter  which  potentially  provides 
60  dB  of  shielding  effectiveness  can  be  rendered  totally 
Ineffective  by  the  haphazard  Incorporation  of  apertures  and 
penetrators. 

Some  apertures  and  penetrators  are  invariably 
necessary.  They  should,  however,  be  limited  to  the 
minimum.  The  required  penetrators  for  DAS3  Include  the 
power  cable,  data,  and  voice  signal  lines.  The  apertures 
Include  side  and  rear  van  doors,  air-conditioner 
Installation  holes  and  vents,  and  Installation  holes  for  the 
power  and  signal-entry  panels.  Each  of  the  planned  0AS3 
apertures  and  penetrators  has  been  addressed  in  this  initial 
HEMP  study  and  appropriate  treatments  have  been  proposed. 
Any  apertures  or  penetrators  which  are  added  to  the  DAS 3 
design  must  each  be  specifically  examined  for  possible 
detrimental  effects  to  the  expected  HEMP  protection. 
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6.6  Standard  Requirement  for  Closed  Doors 


The  standard  operating  procedures  for  DAS3  must 
require  that  all  van  doors  be  kept  shut  as  much  as 
possible.  Whenever  any  one  of  the  doors  Is  open/  the 
shielding  effectiveness  of  the  XM971  semitrailer  van  Is 
predicted  to  be  well  below  the  level  required  for  damage 
protection  against  the  HEMP  environment.  DAS3  is  considered 
vulnerable  to  HEMP  whenever  any  door  Is  not  completely 
closed  and  latched. 

It  Is  recommended  that  DAS3  operations 
documentation  clearly  reflect  this  requirement.  It  Is 
further  recommended  that  an  appropriate  sign  be  promt nantly 
placed  next  to  each  door. 

. , 

Maintenance  documentation  should  also  require  that 
all  doors  be  checked  periodically  and  adjusted  If  necessary 
to  assure  that  they  seal  properly  when  closed  and  latched 
(see  also  sect.  6.7).  In  order  to  provide  a proper 
electromagnetic  seal,  positive  pressure  must  be  applied  to 
compress  the  gasketing  around  the  entire  perimeter  of  the 
door. 

If  It  Is  decided  that  doors  cannot  be  effectively 
kept  closed,  or  If  HEMP  hardness  Is  required  at  all  times 
Including  during  open-door  periods,  then  a double  door  or 
shielded  vestibule  arrangement  Is  necessary  (see  sect.  7.3). 


6.7  Hardness-Assurance  Procedures 

Routine  required  maintenance  procedures  should  be 
established  whereby  the  continued  effectiveness  of  HEMP 
protection  measures  can  be  assured.  Maintenance 
documentation  should  require  periodic  examination  or  testing 
of  all  Important  HEMP-protect I on  measures  and  should  call 
for  appropriate  repair,  replacement,  or  adjustment  as 
necessary. 

As  a minimum.  Inspection  or  testing  should  be 
performed  to  verify  the  following. 


(1) 


Grounding  systems 

(a)  proper  Installation 

(b)  good  electrical  continuity 
connections  and  wiring 


of 


al  1 
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(2) 


(3) 


(4) 


Van 

I ntegrl ty 

(a) 

no  openings  or  loose  members 
walls/  floors/  or  celling 

I n van 

(b) 

all  metal  grills,  filters,  etc. 
Installed 

properly 

(c) 

all  removable  panels  tightly  and 
installed 

properly 

(d) 

all  unused  connectors  or  holes 
and  power  entry  panels  properly 
capped 

In  signal 
sealed  or 

Shielding 
(a)  all 


(b) 


Cc) 


(d) 


cable  shields  (If  any)  properly 
Installed  and  In  good  physical  condition 
door  seals  in  good  physical  condition 
(l.e.,  no  breaks/  not  crushed  or 
otherwise  distorted) 

door  seals  and  mating  surfaces  clean  and 
bare  for  good  electrical  contact  (I.e., 
no  dirt#  grease/  or  nonconductl ve  paint) 
proper  closing  of  doors;  when  closed  and 
latched/  doors  should  apply  a positive 
pressure  on  the  electromagnetic  gasketing 
around  the  entire  perimeter  of  the  door 
In  such  a way  as  to  slightly  compress  the 
gasket 


TPD 1 

(a) 

(b) 


5 

proper  Installation  of  all  TPD's 
proper  electrical  operation  of 
filters  and  transient-suppression  devl 
or  cl rcul try 


all 
I ces 


All  the  above  checks  (except  4b)  should  be  performed 
routinely  at  frequent  Intervals  (at  least  once  a year)  and 
also  following  any  physical  movement  of  the  equipment.  All 
the  above  checks  except  the  last  (4b)  can  be  performed  by 
operations  personnel. 

Some  concern  has  been  raised  by  TACMIS  PMO  and  others 
that  the  force  needed  to  close  and  latch  the  van  doors  might 
be  excessive.  A specification  for  the  S-280  shelter/ 
Ml L-S-55286C(EL)  (pending  approval  to  supersede 
Ml L-S-55286B( EL),  dated  22  September  1975)/  addresses  this 
question  for  that  shelter.  This  new  S-280  specification 
Includes  a requirement  for  a modification  kit  for  RFI 
protection  (MK-1079)  which  Is  Intended  to  bring  HEMP 
shielding  up  to  a 60-dB  level. 
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The  proposed  specification  requires  (In  sect.  3.7.2) 
that  the  door  latch  torque  not  exceed  15  ft-lb  maximum  when 
the  RFI  kit  Is  not  Installed  or  30  ft-lb  when  the  kit  Is 
Installed.  Testing  requirements  (sect.  4.6.16  of 
specification)  state:  "Torque  measurements  shall  be  made 
using  a torque  wrench  fitted  with  an  adapter  which  seals 
over  the  outside  door  handle  and  In  line  with  the  shaft 
centerline.  The  door  shall  then  be  opened  and  closed  using 
the  torque  wrench.  Measurements  shall  be  made  over  the 
entire  working  range  of  the  latch  In  both  cases." 


7.  SUGGESTED  OPTIONAL  HARDENING  MEASURES  FOR  ADDED 

CONFIDENCE 

This  section  contains  a discussion  of  optional  HEMP 
hardening  measures  considered  desirable  for  DAS3.  These 
measures  are  suggested  as  means  for  providing  additional 
margins  of  protection  or  added  confidence.  Any  of  these 
measures  which  can  be  Implemented  without  cost  Impact  should 
be  implemented. 

Two  of  the  measures/  gasketing  around  MEP  access  doors 
and  shielded  power  cables/  are  possible  hardening  measures 
to  assure  hardness  of  the  MEP,  although  these  are  not  known 
to  be  necessary  or  adequate  based  on  this  study.  Various  of 
these  optional  hardening  measures  could  be  needed  If  future 
analysis  reveals  deficiencies. 


7.1  Gasketing  around  MEP  Access  Doors 


Installation  of  conductive  gasketing  around  each  of 
the  access  doors  on  the  MEP  units  would  significantly  reduce 
HEMP-Induced  field  levels  within  the  MEP-005A  housing.  This 
would  reduce  transients  coupled  to  Internal  cable 
harnesses.  Experimentation  with  such  shielding  was 
performed  for  an  HEMP  assessment  of  a similar  15-kW 
generator  (see  sect.  1.2.3).  The  results  of  that  experiment 
were  good  although  the  shielding  technique  used  Is  not 
recommended  as  It  ts  not  sufficiently  durable. 

Shielding  of  the  MEP  access  doors  and  shielding  of 
the  main  external  power  cables  (see  sect.  7.6)  are 
top-priority  and  very  effective  measures  for  enhancing  the 
HEMP  hardness  of  the  MEP-005A  If  hardening  Is  considered 
necessary. 
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3 . 4 Fault  Avoldance/Fault  Tolerance 

The  techniques  used  to  combat  HEMP-1 nduced  problems 
can  be  divided  Into  two  broad  categories:  fault  avoidance 
and  fault  tolerance.  Fault,  as  used  here,  refers  to  any 
abnormal  condition  of  hardware,  software,  or  data  that  may 
cause  a deviation  In  the  Information-processing  behavior 
from  the  expected  and  desired  sequence.  A fault  may  be  a 
component  failure  (damage)  or  may  be  any  of  the  various 
types  of  upset  conditions. 

Fault  avoidance  Is  an  arrangement  whereby  a system, 
subsystem,  or  circuit  avoids  a fault  condition  In  spite  of 
the  presence  of  a disturbance  (such  as  an  HEMP-1  nduced 
transient).  Fault  avoidance  Includes  Installation  of 
hardware  to  reduce  a transient  to  an  acceptable  level  or 
designing  the  hardware  so  that  the  system  Is  Insensitive  to 
the  transient  or  both.  This  Includes  (1)  Installation  of 
TPD's  (surge-suppression  devices  and  filters),  (2)  proper 
grounding,  bonding,  and  shielding,  and  (3)  design  of 
transient-resistant  circuits. 

Fault  tolerance  Is  an  arrangement  whereby  a system, 
subsystem,  or  circuit  continues  to  operate  In  the  expected 
manner  In  spite  of  a fault.  Electrical  circuitry  or  other 
hardware,  software,  or  operating  procedures  are  specially 
designed  or  supplemented  so  that  faults  are  detected  and  are 
either  Ignored,  corrected,  or  otherwise  mollified. 

Fault  avoidance  Includes  all  the  common 
HEMP-hardenl ng  measures  recommended  for  general  electronic 
systems  for  protection  against  damage.  Fault-avoidance 
techniques  are  Implemented  In  hardware.  Fault-tolerance 
measures  can  be  Implemented  In  hardware,  software,  standard 
operating  procedures,  or  combinations  of  these. 
Fault-tolerance  measures  can  be  used  to  provide  the 
additional  protection  needed  by  computer  systems  and 
equipment  In  order  to  tolerate  upset  faults  (see  sect.  3.5 
and  3.6  for  further  discussion  of  fault-avoidance  and 
fault-tolerance  techniques). 


3.5  Design  Guidelines  for  Fault  Avoidance 


The  purpose  of  fault  avoidance  Is  to  design  a 
system,  subsystem,  or  circuit  so  that  a fault  Is  prevented 
from  occurring.  Fault  avoidance  Includes  Installation  of 
hardware  to  reduce  a transient  to  an  acceptable  level. 
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designing  the  hardware  so  that  the  unit  is  Insensitive  to 
the  transient,  or  both.  This  includes  (1)  Installation  of 
TPD's  ( surge-suppress ion  devices  and  filters),  (2)  proper 
grounding,  bonding,  and  shielding,  and  (3)  design  of 
transient-resistant  circuits. 

t i 

Fault  avoidance  includes  all  the  common 
HEMP-hardenl rig  measures  recommended  for  general  electronic 
systems  for  protection  against  damage.  Fault-avoidance 
measures  are  implemented  In  hardware,  unlike  fault-tolerance 
measures  which  may  be  Implemented  in  hardware,  software, 
operating  procedures,  or  combinations  of  these. 

Fault-avoidance  and  fault-tolerance  measures  together  can 
protect  against  upset.  Fault  tolerance  Is  not  an  effective 
technique  for  damage  protection. 

The  general  fault-avoidance  types  of  hardening 
measures  are  discussed  elsewhere  and  will  not  be  further 
defined  here.  What  is  Important  to  discuss  Is  the  need  for 
fault-avoidance  measures  and  the  extent  that  they  should  be 
installed  for  ADPE.  With  a system  that  includes  ADPE,  the 
designer  must  employ  fault-avoidance  measures  as  a first 
line  of  defense.  It  is  extremely  difficult  to  harden  most 
ADPE  configurations  with  faul t-tolerance  measures  alone, 
invariably,  the  most  cost-effective  approach  to  total  HEMP 
hardness  Involves  a good  fault-avoidance  scheme  supplemented 
with  fault-tolerance  measures  as  needed. 

A comprehensive  Implementation  of  normal  hardware 
hardening  measures  Is  required  if  transients  are  to  be 
reduced  to  reasonable  levels  within  the  system  environment. 

Highly  desirable  is  a good  overall  shield  Inclosure  around 
the  overall  system,  plus  some  attempt  at  shielding 
Individual  system  elements  within  zone  1,  thus  providing  two 
levels  of  shielding  between  sensitive  circuitry  and  the  HEMP 
environment.  As  a minimum,  one  level  of  shielding  is 
required.  The  fault-tolerance  alternative  to  hardening 
would  require  many  redundant  circuits  and  components,  for 
damage  protection  alone,  and  could  not  be  as 
cost-effectl ve. 

In  addition  to  shielding,  all  penetrators  and 
apertures  must  be  treated  to  at  least  some  degree.  Some 
form  of  HEMP  TPD's  (filters,  surge  suppressors,  or  both) 
should  be  applied  to  all  conductors  which  penetrate  the 
overall  shield  boundary.  if  a system  has  an  overall 
shielded  Inclosure  (zone  0/1  boundary),  then  as  a rule.  It 
Is  by  far  the  least  expensive  option  to  treat  possible  leaks 
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7.2  Internal  Van  Ground 


A floating  ground  system,  grounded  to  earth  at  one 
point,  would  be  optimum  from  an  HEMP-protectlon  standpoint 
for  the  Internal  van  environment.  This  Is  desired  but  not 
required.  This  type  of  ground  system  would  be  the  most 
effective  means  of  Isolating  the  AD PE  from  transients 
Induced  on  the  van  external  walls,  external  cables,  and 
external  ground  system. 

Such  a ground  system  could  consist  of  a conducting 
false  floor  raised  perhaps  6 In.  off  the  van  bottom.  This 
floor  would  be  Isolated  electrically  from  the  van  structure 
except  at  a single  point.  A central  very-low-lmpedance 
ground  strap  would  connect  directly  from  this  false  floor  to 
ground  at  the  entry  panel.  All  equipment  would  be  well 
grounded  to  equipment  racks  which  would  be  well  grounded  to 
this  floating  ground  floor  at  their  bases.  Interrack  cables 
could  be  routed  beneath  the  floor  for  convenience. 


7.3  Vestibule  for  Van  Entrance 

A vestibule  arrangement  could  serve  to  block  HEMP 
energy  from  entering  a van  through  an  entrance  doorway. 
This  measure  could  be  used  as  an  alternative  to  keeping  van 
doors  closed  or  could  be  used  for  added  protection  where 
Inadequate  shielding  Is  provided  by  the  existing  door.  When 
used  In  combination  with  two  shielded  doors,  maximum 
protection  would  be  attained. 

Figure  4 shows  several  possible  vestibule 
arrangements  which  take  advantage  of  the  waveguide  below 
cutoff  principles  described  by  Campl ,12  The  predicted 
shielding  effectiveness  (S),  In  dB,  provided  by  an  open, 
rectangular-cross-section  vestibule  with  depth  c and  maximum 
opening  size  b Is  calculated  as  follows: 

27.3c 

S - . 

b 


12  Morris  Campl,  Survey  and  Review  of  Aperture  Shielding 
for  EMP/RFI  Fields,  Harry  Diamond  Laboratories,  HDL-TM-78-25 
(December  1978). 
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failures.  The  same  repair  procedure  as  described  for  the 
first  damage  class  must  be  performed  to  restore  the  system 
to  Its  complete  ready  state.  This  class  of  failure  may  be 
very  serious  If  the  time  required  to  repair  the  failure  Is 
long;  in  this  case.  It  becomes  highly  probable  that  a 
subsequent  failure,  leading  to  total  system  failure,  will 
occur  before  the  repair.  Further,  If  the  system  is  required 
to  operate  In  an  environment  of  multiple  HEMP  events,  then 
the  type  of  failure  may  occur  repeatedly  In  a relatively 
short  time,  resulting  In  the  loss  of  all  redundant  units. 
Further,  If  the  redundant  units  are  the  hot  or  warm  backup 
type,  and  the  failure  Is  due  to  a transient  on  a power  line 
or  other  active  cable  or  bus,  all  units  might  be  lost 
s Imul taneousl y . 

The  upset  case  Is  divided  into  four  classes  as 
shown  In  table  IV.  The  first  class  Is  the  most  serious  and 
x refers  to  the  situation  where  a fault  has  occurred  and  has 
'gone  undetected.  Since  the  fault  Is  undetected,  the 
^computer  system  and  operations  personnel  are  unaware  of  the 
problem  and  can  take  no  corrective  action.  There  is  no 
^solution  If  such  a fault  occurs.  A typical  example  might  be 
the  mlscommunicatlon  of  information,  causing  faulty  results 
to  be  generated.  This  class  of  upset  can  be  extremely 
serious  depending  on  the  nature  of  the  system's  mission.  In 
a communications  switch,  for  Instance,  It  might  mean  simply 
the  loss  of  a call  or  Information  packet.  On  the  other 
hand.  It  might  mean  the  distortion  of  critical  Information 
like  a routing  table.  This  class  of  fault  points  out  the 
Important  fact  that  the  highest  priority  requirement  for  any 
faul t-tolerance  measures  employed  Is  that  they  must  be  able 
to  detect  the  fault  they  are  Intended  to  alleviate. 

The  second  upset  class  Is  generally  less  serious 
than  the  first  In  that  the  upset  Is  detected,  so  at  least 
the  system  Is  aware  that  faulty  performance  may  result. 
This  class  is  still  extremely  undesirable  since  the  fault  Is 
not  correctable.  As  an  example,  say  the  system  has 
over-wr I tten  Irreplaceable  data  on  a storage  unit  or  has 
lost  Irreplaceable  call  routtng  Information.  Certain 
functions  are  lost  with  no  chance  for  correction  or 
reproduction.  If  key  operation  Information  Is  lost  on  a 
storage  device  or  In  memory,  then  that  operation  of  the 
system  Is  lost.  This  event  may  not  seem  likely,  but  It  Is 
possible.  It  points  to  the  necessity  for  maintaining  good 
redundant  copies  of  all  system-critical  software  and  data. 
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The  third  and  fourth  upset  classes  deal  with 
detectable  and  correctable  faults.  In  both  cases  operation 
can  continue  after  a delay  during  which  the  correction  or 
restoration  Is  performed.  These  classes  are  the  least 
serious.  Examples  of  automatic  fault  detection/correction 
are  the  numerous  error-checking  schemes  employed  by  most 
computer  systems  for  data  transmission  and  for  storage  and 
retrieval  of  Information.  Many  machines  and  much  software 
also  employ  various  types  of  checking  techniques  to  some 
extent  In  computations.  If  the  detection  and  correction 
process  Is  automatic#  then  the  only  loss  Is  In  terms  of 
degradation  of  system  throughput. 

An  example  of  an  automatic  detection/ correct! on 
process  might  be  a communication  network  control  node  that 
Identifies  a transmission  error  and  requests  from  the  sender 
a retransmission.  Such  a delay  ts  usually  acceptable  and  In 
fact  common,  unless  such  errors  occur  to  the  extent  that 
system  throughput  cannot  keep  up  with  the  network  load 
demands.  If  restoration  requires  human  Intervention,  then 
the  delay  Incurred  Is  generally  much  longer.  Such  a delfty 
would  not  be  acceptable  for  a system  mission  requlrlw 
real-time,  continuous  operation. 

It  Is  Important  to  note  a potential  problem  In 
tolerating  HEMP-Induced  upsets.  HEMP  may  cause  massive 
parallel  upsets  of  many  types.  These  upsets  may  be 
Interdependent  and  may  overload  the  system's  ability  to 
carry  out  designed  fault-tolerance  procedures. 

The  mission  Impact  of  the  above  classes  depends  on 
the  nature  of  the  mission.  It  ts  up  to  the  system  designer 
to  determine  whether  his  system's  mission  can  tolerate 
various  types  of  failures  and  to  design  the  system  so  that 
only  tolerable  failures  will  occur.  It  Is  of  course 
Inevitable  that  failures  and  upsets  of  some  nature  will 
occur.  It  Is  possible,  however,  through  use  of  HEMP 
hardening  measures.  Including  good  faul t-tolerance 
techniques,  to  attain  any  degree  of  reliability  required. 
With  a thorough  analysis  of  the  system's  mission  and  an 
understanding  of  the  hardening  options,  the  designer  can 
determine  the  necessary  hardening  measures  and  can  minimize 
the  design  cost. 
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The  shielding  effectiveness  Is  greater  than  or 
equal  to  that  calculated  by  the  above  equation  up  to  the 
cutoff  frequency.  The  cutoff  frequency  (F),  In  MHz,  for 
such  a vestibule  with  maximum  opening  dimension  b.  In 
Inches,  Is  calculated  as  follows: 

5900 

F - . 

b 

The  DAS3  side  door  Is  37.12  In.  wide  and  76.06  in. 
tall.  For  an  appropriate  vestibule  (without  an  additional 
door),  48  In.  wide  and  78  In.  tall,  the  shielding 
effectiveness  for  various  depths  Is  given  In  table  VI.  The 
cutoff  frequency  for  a 78-In. -tall  vestibule  Is  75.6  MHz. 


TABLE  VI.  SHIELDING  EFFECTIVENESS  OF  A 48  BY  78  In. 
VESTIBULE  WITH  OPEN  END 


Depth 

(ft) 

Depth 

(In.) 

Shielding  effectiveness 
(dB) 

4 

48 

16.8 

6 

72 

25.2 

8 

96 

33.6 

10 

120 

42.0 

12 

144 

50.4 

14 

168 

58.8 

15 

180 

63.0 

16 

192 

67.2 

18 

216 

75.6 

20 

240 

84.0 

If  a door  were  used  on  the  entrance  to  the 
vestibule  then  the  combined  shielding  effectiveness  of  the 
door  and  vestibule  assembly  would  be  the  sum  of  the 
shielding  effectiveness  provided  by  the  vestibule,  as  given 
In  table  VI,  and  the  shielding  effectiveness  of  the  door. 

For  example,  assume  (1)  a normal  van  door  that  Is 
open,  (2)  a properly  constructed  and  Installed  48  by  78  by 
96  In.  vestibule,  and  (3)  a moderate-quality  30-dB  closed 
door  on  the  vestibule.  The  shielding  effectiveness  of  the 
entryway  would  be  63.6  dB  (33.6  ♦ 30).  Such  an  entryway 
would  adequately  support  a van  with  an  effective  60  dB  of 
shielding.  If  the  Inner  door  (normal  van  door)  were  also 
closed  and  it  provided  30  dB  of  protection,  then  the 
shielding  effectiveness  of  the  entryway  would  be  93.6  dB. 


As  another  example,  the  4-ft-deep  vestibule  from 
table  VI,  with  40-dB  Inner  and  outer  doors,  would  provide 
16.8  dB  with  both  doors  open,  56.8  dB  with  one  door  closed, 
and  96.8  dB  with  both  doors  closed.  One  door  closed  would 
provide  nearly  enough  attenuation  to  avoid  degrading  the 
maximum  expected  60  dB  provided  by  the  XM971  semitrailer 
van. 


The  requirements  for  construction  of  a vestibule 
for  a 60-dB  application12'1-  are  as  follows:  The  floor,  roof 
and  walls  must  be  of  metal.  Any  common  construction  metals 
could  be  used.  Any  thickness  adequate  for  structural 
strength  would  be  sufficient.  The  pieces  making  up  the 
walls,  floor,  and  roof  should.  In  general,  be  as  large  as 
possible.  If  multiple  panels  are  used,  a bolt  or  rivet 
spacing  of  3 In.  or  less  should  be  used.  A similar  bolt 
spacing  Is  required  for  all  other  mating  joints  as  well. 
Where  the  walls  join  the  roof  and  floor,  one  mating  piece 
should  be  flanged  (bent  at  90  deg)  so  that  It  can  overlap 
the  other.  This  latter  criterion  Is  not  necessary,  but  Is 
desirable.  Alternatively,  both  mating  pieces  could  be 
connected  to  a metal  structural  support  so  long  as  no  gap  or 
opening  Is  allowed.  The  most  critical  mating  connection  is 
at  the  van.  Here  again  a flanged  arrangement  would  be  best 
with  a 3 In.  or  less  bolt  spacing.  A conductive  gasket  12 
should  be  used  at  the  van/vest! bule  joint  to  assure  a good 
bond.  The  gasket  Is  especially  Important  here  since  the 
connecting  surfaces  are  not  likely  to  mate  tightly  and  since 
this  joint  will  be  disconnected  often  for  transit. 

There  Is  no  reason  that  a vestibule  as  proposed 
above  could  not  be  disassembled,  stowed  on.  In,  or  under  the 
van  for  transit,  and  reassembled  at  a new  site.  Use  of  an 
adequate  vestibule  could  totally  eliminate  possible  problems 
because  of  an  Inability  to  meet  the  proposed  standard 
requirement  for  closed  entry  doors  (see  sect.  6.6). 

Figure  5 provides  two  examples  of  the  use  of  a 
vestibule  for  connecting  two  vans.  It  Is  common  with  many 
Army  systems  (such  as  the  Combat  Service  Support  System)  to 
configure  vans  side  by  side,  enr4  to  end,  or  side  to  end,  and 

12Morrls  Campl,  Survey  and  Review  of  Aperture  Shielding 
for  EMP/RFI  Fields,  Harry  Diamond  Laboratories,  HDL-TM-78-25 
(December  1978). 

13Morrls  Campl,  Survey  and  Review  of  Building  Shielding  to 
Electromagnetic  Waves  from  EMP,  Harry  Diamond  Laboratories, 
HDL-TM-78-23  (November  1978). 
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The  dimensions  a,  b , and  c in  figure  5 correspond 
to  those  used  In  the  previous  equations  of  this  section  for 
calculating  effectiveness  and  cutoff  frequency.  Dimension  c 
Is  not  shown  In  figure  5b/  where  It  Is  the  distance  from  the 
vestibule  entrance  to  the  first  van  doorway. 

Note  that  dimension  c Is  what  was  referred  to  as 
depth  In  table  VI.  A vestibule  without  a door  would  be 
somewhat  Impractical  In  the  configuration  of  figure  5a  since 
to  get  60  dB  from  the  vestibule  alone  would  require 
dimension  c to  be  15  ft.  The  configuration  In  figure  5b 
could  conveniently  provide  60  dB  with  a vestibule  and  no 
door  since  the  dimension  c (distance  from  vestibule  entrance 
to  first  van  door)  could  easily  be  15  ft  or  more.  This 
assumes  that  the  far  end  of  the  vestibule  Is  Inclosed. 

7.4  Ducting  for  Cables  Inside  Van 

Use  of  ducting  around  cables  Inside  the  XM971  van 
Is  an  effective  way  to  minimize  the  transients  coupled  to 
Internal  cabling  by  electromagnetic  fields  present  Inside 
the  van  because  of  faults  In  the  van  shielding.  Such  ducts 
should  be  made  of  conductive  material/  electrically  Isolated 
from  the  van  shell/  and  grounded  to  the  Internal  system 
ground. 


7.5  Shielded  Power  Cables 

Shielding  of  power  cables  Is  a measure  which  could 
be  used  to  minimize  HEMP  transients  coupled  to  power 
conductors.  This  would  serve  to  reduce  HEMP- Induced 
transients  at  both  the  MEP  and  XM971  van  end  of  the  power 
cables.  This  measure  Is  primarily  suggested  as  a possible 
means  to  assure  the  survivability  of  the  MEP  If  hardening  Is 
considered  necessary  (see  also  sect.  7.1). 


7.6  Error  Checking 

For  HEMP  upset  protection  ft  Is  desirable  to  use 
error  checking  codes  for  all  information  stored  and 
transferred  electrically  or  magnetically  In  the  computer 
system.  This  Includes  Information  stored  In  memory/  on 
magnetic  drum,  tape,  and  disk/  In  all  CPU  registers/  in  all 
peripheral  control  registers/  and  In  data  transfer  buffers. 
Error  checking  Is  also  desirable  for  all  Information 
transfers  both  between  CPU  and  all  peripherals  and  between 
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the  communications  controller  and  remote  terminals.  Error 
checking  ultimately  would  also  include  verification  of 
execution  of  machine  instructions. 

Error  checking  should  be  used  In  conjunction  with 
the  other  planned  DAS3  fault-tolerance  measures  to  protect 
against  HEMP-1 nduced  upsets.  Error  checking  is  considered  a 
most  'effective  means  to  detect  upsets.  Extensive  error 
checking  as  outlined  above  would  nearly,  If  not  completely/ 
solve  the  upset  detection  problem  (see  sect.  1.2.1). 

7.7  EMP  Detector 

The  concept  of  an  EMP  sensor  has  considerable  merit 
for  fault-tolerance  applications/  although  such  a scheme  Is 
not  known  to  have  ever  been  used  for  protection  of  ADPE. 
Such  a scheme11  Is  proposed  as  follows: 

"Threat-specific  circumvention  techniques  generally 
Involve  the  detection  of  a nuclear  event  by  an  EMP  sensor 
supplemented  by  some  other  type  of  sensing  system  to 
suppress  false  triggering.  Such  a supplementary  sensor 
might  be  achieved  by  means  of  a photocell.  ...  A sensor 
of  very  great  bandwidth  detects  the  EMP  transient  and 
employs  a very-large-bandwldth  cabling  system  to  provide  an 
off  gate  for  the  main  computing  system/  which  is  located  In 
a heavily  shielded/  underground  shelter.  The  EMP  from  the 
burst  as  It  diffuses  Into  the  heavily  shielded  enclosure  Is 
delayed  In  time  because  of  the  low-pass  frequency 
characteristics  of  the  electromagnetic  shield.  The 
computational  circuits  are  designed  so  that  they  can  be 
temporarily  desensitized  In  such  a way  that  the  EMP  pickup/ 
If  It  occurs/  will  have  little  effect." 

A hardware  Implementation  would  probably  be 
required  to  carry  out  the  deactivation  of  the  computer 
system/  since  high  speed  is  required.  Any  further  recovery 
process  could  be  implemented  in  hardware/  in  software/  or  as 
an  operator  procedure.  A possible  Implementation  of  the  EMP 
sensor  Idea  which  could  be  used  for  DAS3  upset  toleration  Is 
the  following.  The  occurrence  of  an  HEMP  event  could  be 
determined  by  the  detection  of  multtple  or  massive  upsets  in 
the  system.  An  automatic  or  manual  rollback  and  restart 
procedure  could  then  be  Initiated. 


11  L.  W.  Ricketts,  J.  E.  Bridges,  and  J.  Mlletta,  EMP 
Radiation  and  Protective  Techniques,  John  Wiley  A Sons,  New 
York  (1976). 
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S.  PROPOSED  FOLLOW-UP  HEMP  ASSESSMENT 

Additional  study  and  a limited  HEMP  simulation  test  are 
recommended  to  verify  the  predicted  HEMP  survivability  of 
the  DAS3  ADPE,  Including  the  recommended  hardening  measures, 
and  to  Insure  survivability  of  the  DAS3  MEP. 

The  prediction  that  the  DAS3  ADPE  Is  hard  to  the  HEMP 
environment  has  only  low  confidence  because  of  the  several 
limitations  of  this  study,  described  In  section  5.  To 
enhance  the  confidence  of  this  conclusion  and  verify  the 
HEMP  survivability  of  the  ADPE,  for  both  damage  and  upset, 
further  study  Is  proposed  to  Include  examination  of  (1)  the 
actual  ADPE  circuitry,  (2)  the  manner  In  which  It  Is 
Installed  In  the  semitrailer  van,  (3)  actual  Implementations 
of  fault-tolerance  procedures,  (4)  the  selected  power  and 
signal  cables,  and  (5)  the  adequacy  of  measures  used  to  meet 
Important  HEMP-related  specifications  In  the  RFP  (see  sect. 
4). 


An  HEMP  simulation  test  of  DAS3  is  also  recommended  as  a 
final  verification  of  the  predicted  hardness  of  the  ADPE  to 
HEMP-Induced  damage.  Test  verification  of  the  upset 
hardness  of  the  ADPE  Is  not  recommended.  Verification 
testing  of  ADPE  upset  Involves  considerably  more  effort  than 
a test  to  assess  damage  hardness.  Such  expense  Is  not 
considered  justifiable  In  view  of  the  DAS3  mission  and  the 
nature  of  the  planned  fault-tolerance  techniques. 

An  HEMP  simulation  test  Is  necessary  to  reach  an 
adequate  HEMP-survI vabl 1 1 ty  conclusion  for  the  DAS3  MEP. 
Testing  would  provide  data  on  the  HEMP  energy  coupled  to  MEP 
Internal  and  external  cables,  to  be  used  to  conduct  detailed 
circuit  analysis  of  the  MEP-005A  circuitry. 

The  proposed  follow-up  HEMP  study  of  DAS3  would  require 
an  estimated  three  man  months  total  by  one  or  more 
HEMP-exper tenced  engineers  and  should  Include  the  following 
tasks. 

(1)  refine  predicted  HEMP  coupling  to  power  and  signal 
cables 

(2)  determine  the  range  of  damage  threshold  levels  for 
ADPE  (Insure  that  no  unusually  sensitive  circuitry 
Is  present) 
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(3)  determine  whether  protection  measures  called  for  In 
the  RFP  and  In  the  Initial  HEMP  study  are 
Implemented  to  the  degree  required  for  HEMP 
protection 

(4)  determine  whether  actual  Implementation  of 

faul t-tolerance  measures/  as  required  by  the  RFP/ 
is  adequate  for  the  detection  of  upsets  likely  to 
be  Induced  by  HEMP 

(5)  provide  an  enhanced  DAS3  HEMP  survivability 

conclusion  based  on  the  above  tasks 

Two  alternative  HEMP  simulation  tests  are  proposed  to 
verify  the  predicted  DAS3  ADPE  survivability  and  to  assess 
the  survivability  of  the  MEP.  The  first  plan  Involves 
testing  a configuration  consisting  of  the  MEP  and  XM971 
semitrailer  van,  not  Including  the  ADPE/  but  Including 
external  power  and  signal  cables.  Either  a single  MEP-005A 
generator  or  an  AN/MJQ-10A  configuration  of  dual  MEP-005A 
generators  could  be  used  to  yield  equally  good  results.  The 
second  test  proposed  Involves  a test  of  a complete  prototype 
DAS3  CI.e./  same  equipment  as  plan  1/  but  including  final 
Installation  of  ADPE  In  the  semitrailer). 

The  second  test  plan  Is  preferable  to  the  first  since  It 
would  yield  more  complete  data  on  the  system.  The  first 
plan  Is  proposed  as  an  alternative  primarily  because  of  the 
possible  unavailability  of  a complete  prototype  for 
testing. 


Any  HEMP  testing  should  Involve  equipment  which  is  as 
similar  as  possible  to  planned  production  systems.  Any 
deviation  could  seriously  degrade  the  validity  of  test 
results.  Thus/  one  should  discourage  the  use  of  any  Interim 
prototype  like  the  ones  originally  planned  to  be  assembled 
by  Tobyhanna  Army  Depot. 


An  HEMP  simulation  test  would  consist  of  deploying  the 
DAS3  equipment  In  actual  physical  configurations  In  the 
testing  area  of  HEMP  field  simulation  antennas.  The  system 
components  would  be  exposed  to  a simulated  HEMP  environment 
at  or  near  the  postulated  threat  level.  Two  HEMP  simulators 
would  be  used  In  different  phases  of  the  test  to  expose  the 
system  components  to  both  vertically  polarized  and 
horizontally  polarized  HEMP  fields.  The  DAS3  equipment 
would  be  configured  In  various  physical  orientations  with 
respect  to  the  antennas/  In  order  to  determine  worst-case 
HEMP  coupling  to  the  system. 
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Measurements  made  during  HEMP  testing  would  include 
voltage  and  current  levels  coupled  to  Internal  and  external 
cables  and  field  levels  Induced  within  the  semitrailer  van. 
If  the  ADPE  Is  Included/  further  voltage  and  current 
measurements  could  be  made  at  points  within  the  ADP  system 
which  are  (1)  at  HEMP  ports  of  entry/  (2)  In  cables  and 
circuits  near  components  which  are  Inherently  sensitive  to 
damage,  or  (3)  In  cables  and  circuits  near  circuitry  which 
performs  critical  functions. 

An  HEMP  simulation  test  would  involve  both  pre-  and 
post-test  analysis.  The  pretest  analysis  involves 
generation  of  a test  plan  which  Includes  the  physical 
configurations  and  orientations  to  be  examined/  possible 
electrical  configurations  relating  to  the  operating  modes  of 
system  equipments/  and  selection  of  important  test 
measurement  locations  throughout  the  system.  Post-test 
analysis  must  Include  reduction  of  the  test  data  Into  usable 
form,  computer-aided  circuit  analysis  to  predict  actual 
voltages  and  currents  at  components  of  Interest/  and 
formulation  of  the  survivability  conclusion  based  on  test 
results.  Circuit  analysis  ts  necessary  for  two  reasons. 
First/  because  of  the  physical  size  of  the  DAS3  system  and 
the  limitations  of  the  HEMP  simulators/  it  Is  unlikely  that 
threat-level  fields  will  be  provided  throughout  the  system 
area.  This  requires  that  measured  data  be  scaled  up  to 
levels  which  correspond  to  actual  threat.  Circuit  analysis 
Is  then  performed  to  determine  how  system  electronics  would 
perform  at  those  scaled-up  levels. 

The  second  reason  circuit  analysis  is  required  is  *:o 
allow  examination  of  the  safety  margins  between  actual 
measurements  or  scaled-up  measurements  and  the  damage 
threshold  levels  of  electronic  components  or  circuits.  Such 
an  examination  Is  necessary  because  of  the  large  statistical 
variation  between  damage-failure  levels  of  equivalent 
semiconductor  components. 

The  proposed  HEMP  simulation  test  program  would  involve 
the  level  of  effort  estimated  In  table  VII. 
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TABLE  VII.  PROPOSED  TEST  PROGRAM  EFFORT 


r 


Effort 

DAS3  minus  ADPE 

Complete  0AS3 

Pretest  analysis 

6 man  weeks 
(professional ) 

8 man  weeks 
(professional ) 

HEMP  simulator  operation 
(at  )6k  per  week) 

3 weeks 

4 weeks 

Test  support 

6 man  weeks 
(professional ) 

8 man  weeks 
(professional ) 

Post-test  analysis 

8 man  weeks 
(professional ) 

16  man  weeks 
(professional ) 

Final  report  generation 

6 man  weeks 
(professional ) 

6 man  weeks 
(professional ) 
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GLOSSARY 


ADP — Automatic  data  processing* 

ADPE — Automatic  data  processing  equipment. 

AESOP — Army  Electromagnetic  Pulse  Simulator  Operations. 
AESOP  is  a fixed-site,  large-area,  high-level  HEMP  simulator 
at  the  Harry  Diamond  Laboratories'  Woodbrldge  Research 
Facility  at  Woodbrldge,  VA.  Normal  operational  environments 
are  at  approximately  50  kV/m,  free  field,  at  50  m on  the 
centerline.  The  AESOP  simulator  Is  virtually  Identical  to 
the  TEMPS  (Transportable  EMP  Simulator)  In  design  and 
capability  except  that  TEMPS  Is  transportable. 

aperture — Any  opening  In  a shield  that  allows 
electromagnetic  radiation  to  penetrate  the  shielded 
environment.  Common  examples  of  apertures  are  windows, 
doors,  and  vents. 

bonding — The  process  whereby  two  or  more  conductors  are 
fastened  together  to  provide  electrical  continuity.  The 
purpose  of  bonding  Is  to  fabricate  shields,  make  grounding 
connections,  and  Interconnect  circuits. 

central  processing  unit  (CPU) — A unit  of  a computer  that 
Includes  the  circuits  controlling  the  Interpretation  and 
execution  of  Instructions.  Synonymous  with  main  frame. 

checkpoint — A process  whereby  critical  Information  Is 
recorded  on  a backup  or  redundant  storage  medium  for  use  In 
a rollback  or  restart  operation  In  the  event  the  primary 
Information  Is  lost  or  damaged. 

checkpoint  rollback  (CPRB) — A fault-tolerance  technique  used 
to  protect  against  the  effects  of  upset.  A process  whereby 

(1)  critical  information  is  periodically  and  routinely 
recorded  on  a backup  or  redundant  storage  medium  and 

(2)  when  an  upset  fault  Is  detected,  any  lost  or  damaged 
Information  Is  restored  from  the  checkpointed  copy  and  a 
restart  is  performed. 

cold  backup — A cl rcul t/per I pheral /subsystem  that  Is  a 
functional  replacement  for  an  operating  unit  and  Is 
powered-down  and  possibly  physically  disconnected.  (See 
also  "hot  backup,"  "warm  backup.") 
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coverage — The  probability  of  recovery,  given  that  a fault 
occurs. 

CPRB— See  checkpoint  rollback. 

CPU— Central  processing  unit. 

damage — The  Irreversible  failure  of  an  electrical 
component.  Examples  are  (1)  burnout  of  a transistor,  diode, 
or  Integrated  circuit,  (2)  degradation  of  a semiconductor's 
operating  characteristics  such  that  It  will  no  longer 
function  as  Intended,  and  (3)  voltage  breakdown  of  a 
capacitor  or  resistor. 

DAS3 — Decentral  I zed  Automated  Service  Support  System. 

degraded  recovery — The  return  of  the  system  to  a fault-free 
state,  but  with  a reduced  computing  capacity.  This  means 
that  some  hardware  elements  have  been  discarded  without 
replacement,  some  programs  or  data  have  been  lost,  or  some 
functions  have  taken  longer  than  the  allowed  time. 

detection  (fault  detection) — The  first  phase  of  a 
fault-tolerance  process;  the  other  phase  Is  recovery. 
Detection  In  Its  most  general  use  can  take  several  forms,  as 
follows:  (1)  Initial  testing,  which  takes  place  before 

normal  use  and  serves  to  Identify  faulty  hardware  elements 
containing  imperfections  Introduced  during  the  manufacturing 
or  assembly  process.  (2)  Concurrent  (online)  detection, 
which  takes  place  simultaneously  with  normal  operation  of 
the  system.  (3)  Scheduled  (offline)  detection,  which  takes 
place  when  normal  operation  Is  temporarily  Interrupted. 
(4)  Redundancy  testing,  which  serves  to  verify  that  the 
various  forms  of  protective  redundancy  are  themselves 
fault-free,  and  takes  place  either  concurrently  or  at 
scheduled  Intervals. 

determinate  fault — A fault  where  the  value  of  a logic 
variable  assumes  a constant  value  as  a result  of  the  fault. 

distributed  fault — Distributed  (related  multiple)  faults  are 
those  that  affect  two  or  more  variables,  a module,  or  an 
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0S4 — Direct  Support  Unit  Standard  Supply  System. 

EMC — Electromagnetic  compatl bl 1 1 ty. 

EMI — Elecfcmagnetlc  I nterference. 

EMP — Electromagnetic  pulse,  generated  by  detonation  of  a 
nuclear  weapon. 

fault — An  abnormal  condition  of  hardware,  software,  or  data 
that  may  cause  a deviation  of  the  Information-processing 
behavior  from  the  expected  and  desired  sequence.  Fault 
Includes  damage  and  upset  caused  by  EMP. 

fault  avoidance — An  attribute  whereby  a system,  subsystem, 
or  circuit  avoids  a fault  condition  In  spite  of  the  presence 
of  a disturbance  (such  as  an  electrical  transient).  Fault 
avoidance  Includes  Installation  of  devices  to  reduce  a 
transient  to  an  acceptable  level,  designing  the  electronics 
so  that  the  system  Is  Insensitive  to  the  transient,  or  both. 

fault  tolerance — An  attribute  whereby  a system,  subsystem, 
or  circuit  continues  to  operate  In  the  expected  manner  In 
spite  of  a fault.  Electrical  circuitry,  software,  or 
operating  procedures  are  specially  designed  or  supplemented 
so  that  faults  are  detected  and  are  either  Ignored  or 
corrected.  Fault-tolerance  measures  can  be  Implemented  as 
software,  hardware,  operating  procedures,  or  as  combinations 
of  these. 

full  recovery — The  return  of  the  system,  within  allowed  time 
limits,  to  the  conditions  that  existed  before  the  fault 
occurred.  Both  the  hardware  and  software  possess  the  same 
computing  capacity  as  before.  Failed  hardware  modules  are 
replaced  by  spares.  Damaged  Information  (programs  and  data) 
Is  returned  to  a known  good  state  that  existed  before  the 
fault. 

GFE — Government-furnl shed  equipment. 

grounding — A procedure  for  controlling  the  potential  of 
electrical,  electronic,  and  nonelectrical  conductors  within 
a shielded  region  with  respect  to  each  other  and  to  the 
shields.  Grounding  of  electrically  operated  equipment  and 
structural  metal  Is  primarily  for  personnel  protection  and 
the  prevention  of  fire  and  explosion.  Grounding  of 
small-signal  electronic  and  radio  circuits  Is  primarily  to 
protect  components  against  damage  or  malfunction  caused  by 
uncontrolled  potential  differences  (drift)  between  the 
circuit  and  other  conductors  such  as  the  housings,  cabinets, 
shields,  or  other  circuits. 
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GSU — General  Support  Unit. 

Hamming  code — A data  code  which  can  be  corrected 

automatical 1y . 

hardware — Physical  equipment  (as  opposed  to  the  computer 
program  or  method  of  use);  for  example,  mechanical, 
magnetic,  electrical,  or  electronic  devices.  Contrast  with 
software. 

hardware  redundancy — Redundancy  that  Involves  the  use  of 
redundant  components,  circuits,  or  subsystems  (including 
computer  peripherals)  to  protect  against  faults.  Redundancy 
can  be  provided,  so  that  Identical  functions  are  performed 
for  comparison  to  detect  errors,  or  It  may  be  provided  as  a 
means  of  backup  if  an  active  unit  falls. 

HDL— Harry  Diamond  Laboratories.  The  Army's  lead  laboratory 
for  nuclear  weapons  effects  research  and  testing. 

HEMP — Hlgh-altl tude  electromagnetic  pulse. 

HEMP  hardening — The  process  of  Incorporating  design 
practices  with  the  objective  of  providing  survivability  to 
an  HEMP  environment. 

hot  backup — A cl rcut t/perl pheral/subsystem  that  Is  a 
functional  replacement  for  an  operating  unit  and  Is 
powered-up  and  operating.  (See  also  "warm  backup,"  "cold 
backup.") 

Indeterminate  fault — A fault  where  the  value  of  a logic 
variable  varies  throughout  the  duration  of  the  fault. 

Instruction  retry — An  automatic  hardware  or  system  software 
process  whereby  Instruction  results  are  checked  and 
re-executed  If  an  error  Is  detected.  Instruction  retry  can 
be  an  effective  means  for  providing  protection  against 
transient  (temporary)  EMP  upsets  to  Instruction  information 
or  circuitry. 

KVDT — Keyboard  visual  display  terminal. 

local  fault — Local  (single)  faults  are  those  that  affect 
only  single  logic  variables. 

LSI —Large-scale  Integration. 

MEP — Mobile  electric  power. 
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MERAOCOM — Army  Mobility  Equipment  Research  and  Development 
Command. 

MSI — Medium-scale  Integration. 

offline — Pertaining  to  equipment/  devices/  or  storage  media 
that  are  not  under  the  control  of  the  central  processing 
unit.  Contrast  with  online. 

online — Pertaining  to  equipment/  devices,  or  storage  media 
that  are  under  the  control  of  the  central  processing  unit. 
Contrast  with  offline. 

penetratoi — Any  conductive  medium  that  penetrates  a shield 
boundary.  Common  penetrators  Include  pipes,  power  lines, 
ground  conductors,  antennas,  telephone  lines,  and  other 
signal  conductors. 

permanent  fault — A fault  caused  by  Irreversible  failures  of 
components. 

plausibility  checks — Usually  software  or  possibly  human 
checks  which  verify  that  Information  being  processed  or 
which  Is  the  result  of  computations  falls  within  realistic 
bounds.  Plausibility  checks  are  useful  for  detection  of 
errors  caused  by  upset. 

process  redundancy — Redundancy  that  involves  the  multiple 
execution  of  a process  and  comparison  of  the  results. 
Process  redundancy  Is  useful  for  fault  detection. 

real-time — (1)  Pertaining  to  the  actual  time  during  which  a 
physical  process  transpires.  (2)  Pertaining  to  the 
performance  of  a computation  during  the  actual  time  that  the 
related  physical  process  transpires  In  order  that  results  of 
the  computation  can  be  used  In  guiding  the  physical 
process.  (3)  Pertaining  to  an  application  in  which 
response  to  Input  Is  fast  enough  to  affect  subsequent  Input, 
such  as  In  a process  control  system. 

recovery — The  second  phase  of  a fault-tolerance  process;  the 
first  phase  Is  fault  detection.  Recovery  is  the  procedure 
that  Is  Initiated  when  a fault  has  been  detected  In  order  to 
return  the  system  to  normal  operation.  Recovery  may  return 
the  system  to  the  same  state  as  before  the  fault  (see  full 
recovery),  to  a degraded  mode  (see  degraded  recovery),  or  to 
a safe  shutdown  (see  safe  shutdown). 
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RFI — Radio  frequency  Interference. 

rollback — A process  whereby,  upon  the  detection  of  a fault, 
critical  Information  Is  restored  from  a previous  checkpoint 
and  the  process  or  system  Is  restarted  at  the  point  of  that 
checkpoint. 

safe  shutdown — The  limiting  case  of  degraded  recovery.  It 
Is  carried  out  when  the  remaining  computing  capacity  (If 
any)  Is  below  the  minimum  acceptable  threshold.  The  goals 
of  shutdown  are  to  avoid  damage  to  remaining  stored 
Information  and  good  system  elements,  to  cease  Interaction 
with  other  systems  or  human  users  In  a specified  orderly 
fashion,  and  to  deliver  shutdown  messages  and  diagnostic 
information. 

shielding — Separation  of  electromagnetic  environments  by 
barriers  of  hlgh-conduct I vl ty  materials,  usually  metals, 
which  may  be  ferromagnetic.  The  objective  of  shielding  Is 
to  make  the  electromagnetic  environment  In  one  region 
relatively  Independent  of  the  environment  In  an  adjacent 
region  (on  the  other  side  of  the  shield). 

software — In  general:  A set  of  programs,  procedures,  and 
possibly  associated  documentation  concerned  with  the 
operation  of  a data  processing  system;  for  example, 
compilers,  library  routines,  manuals,  circuit  diagrams. 
Software  as  used  In  this  document  does  not  Include 
procedures  and  documentation.  Contrast  with  hardware. 

SOP — Standard  operating  procedures. 

TACMIS  PMO--Tactlcal  Management  Information  Systems  Project 
Management  Office. 

TARCOM-- Army  Tank  Automotive  Materiel  Readiness  Command. 

terminal  protection  device  (TPD) — A protection  device 
applied  to  a penetrator  at  the  point  where  It  enters  a 
shielded  environment  In  order  to  reduce  the  energy  coupled 
Into  system  electrical  circuits  via  that  penetrator.  TPD's 
Include  surge-suppression  devices  and  filters. 
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throughput — The  total  volume  of  work  performed  by  a computer 
system  over  a given  period  of  time. 

time-out  error — Time-out  Is  the  time  allotted  for  certain 
operations  to  occur;  for  example,  response  to  polling  or 
addressing,  or  performance  of  Input/output.  A time-out 
error  occurs  If  the  task  takes  more  time  than  has  been 
al  lotted. 

timer — A hardware  or  software  mechanism  which  monitors 
on-going  tasks  to  assure  that  the  normal  time  required  for 
the  task  Is  not  exceeded.  Timers  are  useful  for  fault 
detection. 

TPD — See  terminal  protection  device. 

transient  fault — A fault  of  limited  duration  caused  either 
by  temporary  malfunctions  of  components  or  by  external 
I nterference. 

trap — A conditional  jump  to  a known  location,  automatically 
activated  by  hardware,  with  the  location  from  which  the  jump 
occurred  recorded.  Traps  are  useful  for  fault  detection. 

TSARCOM — Army  Troop  Support  and  Aviation  Materiel  Readiness 
Command . 

upset — The  unwanted  action  of  a system,  subsystem,  or 
component.  Examples  are  (1)  altering  of  a flip-flop  state, 
(2)  altering  of  one  or  more  bits  In  a memory  word  or 
register,  (3)  communication  errors,  and  (4)  misread, 
miswritten,  or  overwritten  areas  of  storage  or  memory. 

warm  backup — A cl rcul t/per I pheral /subsystem  that  Is  a 
functional  replacement  for  an  operating  unit  and  Is 
powered-up  but  not  In  use.  (See  also  "hot  backup,"  "cold 
backup.") 
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